IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
45 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
45 IPs
Below average
Total Events
8760
Below average by volume
Started / Ended
2026-02-28 02:47 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1090 T1105 T1572
Exfiltration
T1048
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
14.63.217.28 credential_harvester 82% 2x OSINT 1316 3 ssh:bruteforce — 2026-05-10 18:02 evidence →
201.63.223.138 credential_harvester 70% 1x OSINT 401 3 ssh:bruteforce 201-63-223-138.customer.tdatabrasil.net.br 2026-04-29 06:02 evidence →
2.57.122.191 opportunistic_bruter 67% DROP1x OSINT 145 3 ssh:bruteforce — 2026-05-13 01:03 evidence →
14.103.120.138 scanner 59% 1x OSINT 191 2 ssh:bruteforce — 2026-05-09 12:33 evidence →
59.36.78.66 credential_harvester 58% 1x OSINT 107 2 ssh:bruteforce — 2026-05-09 12:29 evidence →
172.235.40.131 web_probe 57% 39 3 http:scanssh:bruteforce — 2026-05-10 14:35 evidence →
59.12.160.91 credential_harvester 56% 1x OSINT 980 2 ssh:bruteforce — 2026-05-02 10:50 evidence →
168.167.72.132 credential_harvester 56% 1x OSINT 936 2 ssh:bruteforce — 2026-05-01 11:48 evidence →
103.191.14.210 credential_harvester 56% 1x OSINT 888 2 ssh:bruteforce — 2026-04-28 15:33 evidence →
202.165.15.132 credential_harvester 56% 1x OSINT 702 2 ssh:bruteforce — 2026-04-19 20:31 evidence →
103.20.223.56 credential_harvester 55% 1x OSINT 553 2 ssh:bruteforce — 2026-04-23 05:27 evidence →
103.237.144.204 credential_harvester 55% 1x OSINT 533 2 ssh:bruteforce — 2026-05-04 10:20 evidence →
78.44.192.210 credential_harvester 55% 1x OSINT 421 2 ssh:bruteforce — 2026-03-28 17:00 evidence →
103.200.25.79 credential_harvester 53% 1x OSINT 114 2 ssh:bruteforce — 2026-03-30 04:23 evidence →
41.204.63.118 malware_dropper 52% 1x OSINT 92 2 ssh:bruteforce — 2026-03-29 03:27 evidence →
14.224.227.189 malware_dropper 52% 1x OSINT 91 2 ssh:bruteforce — 2026-03-28 12:03 evidence →
106.12.138.190 scanner 51% 1x OSINT 57 2 ssh:bruteforce — 2026-05-01 09:49 evidence →
123.48.142.249 credential_harvester 51% 698 2 ssh:bruteforce — 2026-04-22 09:55 evidence →
60.244.155.70 credential_harvester 51% 658 2 ssh:bruteforce — 2026-03-29 04:50 evidence →
152.32.174.67 credential_harvester 51% 562 2 ssh:bruteforce — 2026-04-12 12:05 evidence →
178.128.92.222 credential_harvester 50% 420 2 ssh:bruteforce — 2026-04-01 07:22 evidence →
103.249.84.18 credential_harvester 50% 410 2 ssh:bruteforce — 2026-04-04 23:39 evidence →
103.62.152.202 credential_harvester 50% 359 2 ssh:bruteforce 202.152.62.103.in-addr.arpa.cable21.net 2026-03-31 04:35 evidence →
45.195.221.26 credential_harvester 49% 271 2 ssh:bruteforce — 2026-04-20 03:49 evidence →
103.82.27.19 reconnaissance 49% 2651 2 ssh:bruteforce — 2026-03-29 02:18 evidence →
86.54.42.185 credential_harvester 49% 237 2 ssh:bruteforce — 2026-03-29 01:26 evidence →
60.190.239.92 scanner 49% 213 2 ssh:bruteforce — 2026-04-02 05:23 evidence →
14.103.131.112 scanner 48% 123 2 ssh:bruteforce — 2026-04-11 05:40 evidence →
222.208.64.40 scanner 47% 97 2 ssh:bruteforce 40.64.208.222.broad.nc.sc.dynamic.163data.com.cn 2026-04-02 13:58 evidence →
103.82.37.117 malware_dropper 47% 69 2 ssh:bruteforce smtp.pagymogo.ink 2026-04-02 00:09 evidence →
186.56.11.2 opportunistic_bruter 47% 69 2 ssh:bruteforce — 2026-03-28 13:22 evidence →
163.43.142.110 malware_dropper 46% 46 2 ssh:bruteforce — 2026-03-29 02:56 evidence →
109.73.207.89 opportunistic_bruter 46% 46 2 ssh:bruteforce — 2026-03-29 02:16 evidence →
14.103.117.141 scanner 46% 41 2 ssh:bruteforce — 2026-04-27 13:56 evidence →
171.243.149.203 credential_harvester 46% 317 2 ssh:bruteforce — 2026-03-28 20:28 evidence →
180.76.172.156 scanner 43% 2x OSINT 44 2 ssh:bruteforce — 2026-05-10 23:51 evidence →
203.83.231.93 scanner 40% 1x OSINT 20 2 ssh:bruteforce — 2026-03-28 16:22 evidence →
114.217.149.27 scanner 36% 1x OSINT 14 2 ssh:bruteforce — 2026-05-10 14:53 evidence →
8.134.239.76 scanner 36% 28 2 ssh:bruteforce — 2026-05-13 02:29 evidence →
59.37.58.205 scanner 35% 17 2 ssh:bruteforce — 2026-03-28 11:42 evidence →
220.178.8.154 scanner 33% 33 2 ssh:bruteforce — 2026-04-11 12:33 evidence →
2.57.121.86 opportunistic_bruter 33% DROP 30 2 ssh:bruteforce — 2026-04-12 19:04 evidence →
134.0.106.249 scanner 24% 14 2 ssh:bruteforce — 2026-03-29 04:53 evidence →
121.40.84.227 scanner 23% 18 2 ssh:bruteforce — 2026-04-27 01:43 evidence →
103.29.70.204 scanner 22% 8 2 ssh:bruteforce — 2026-03-28 14:15 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds