IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
52 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
52 IPs
Below average
Total Events
8357
Below average by volume
Started / Ended
2026-02-28 17:23 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1090 T1105 T1572
Exfiltration
T1048
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
172.191.157.64 credential_harvester 77% 1x OSINT 1242 3 ssh:bruteforce — 2026-05-09 19:45 evidence →
2.57.122.195 opportunistic_bruter 68% DROP1x OSINT 175 3 ssh:bruteforce — 2026-05-13 07:03 evidence →
172.236.119.165 web_probe 63% 45 3 http:scanssh:bruteforce — 2026-05-13 16:45 evidence →
172.234.217.129 web_probe 60% 43 3 http:scanssh:bruteforce 172-234-217-129.ip.linodeusercontent.com 2026-05-11 23:48 evidence →
14.103.120.138 scanner 59% 1x OSINT 191 2 ssh:bruteforce — 2026-05-09 12:33 evidence →
172.235.40.131 web_probe 59% 40 3 http:scanssh:bruteforce — 2026-05-11 06:06 evidence →
59.36.78.66 credential_harvester 58% 1x OSINT 107 2 ssh:bruteforce — 2026-05-09 12:29 evidence →
72.253.251.7 credential_harvester 56% 1x OSINT 942 2 ssh:bruteforce — 2026-04-15 12:32 evidence →
168.167.72.132 credential_harvester 56% 1x OSINT 936 2 ssh:bruteforce — 2026-05-01 11:48 evidence →
201.249.192.30 credential_harvester 56% 1x OSINT 931 2 ssh:bruteforce — 2026-05-05 09:02 evidence →
202.165.15.132 credential_harvester 56% 1x OSINT 702 2 ssh:bruteforce — 2026-04-19 20:31 evidence →
45.119.212.99 credential_harvester 56% 1x OSINT 688 2 ssh:bruteforce — 2026-05-02 05:12 evidence →
103.20.223.56 credential_harvester 55% 1x OSINT 553 2 ssh:bruteforce — 2026-04-23 05:27 evidence →
103.237.144.204 credential_harvester 55% 1x OSINT 533 2 ssh:bruteforce — 2026-05-04 10:20 evidence →
195.250.72.168 credential_harvester 55% 1x OSINT 412 2 ssh:bruteforce — 2026-03-29 02:00 evidence →
2.57.122.196 opportunistic_bruter 55% DROP1x OSINT 90 3 ssh:bruteforce — 2026-05-02 01:03 evidence →
210.79.191.76 credential_harvester 53% 1x OSINT 190 2 ssh:bruteforce — 2026-03-29 09:41 evidence →
120.48.102.177 scanner 53% 1x OSINT 147 2 ssh:bruteforce — 2026-04-25 00:35 evidence →
103.200.25.79 credential_harvester 53% 1x OSINT 114 2 ssh:bruteforce — 2026-03-30 04:23 evidence →
106.12.138.190 scanner 51% 1x OSINT 57 2 ssh:bruteforce — 2026-05-01 09:49 evidence →
128.14.237.154 credential_harvester 51% 1x OSINT 56 2 ssh:bruteforce — 2026-05-06 02:12 evidence →
103.250.11.118 credential_harvester 51% 815 2 ssh:bruteforce — 2026-04-16 14:02 evidence →
123.48.142.249 credential_harvester 51% 698 2 ssh:bruteforce — 2026-04-22 09:55 evidence →
152.32.174.67 credential_harvester 51% 562 2 ssh:bruteforce — 2026-04-12 12:05 evidence →
178.128.92.222 credential_harvester 50% 420 2 ssh:bruteforce — 2026-04-01 07:22 evidence →
103.62.152.202 credential_harvester 50% 359 2 ssh:bruteforce 202.152.62.103.in-addr.arpa.cable21.net 2026-03-31 04:35 evidence →
45.195.221.26 credential_harvester 49% 271 2 ssh:bruteforce — 2026-04-20 03:49 evidence →
103.82.27.19 reconnaissance 49% 2651 2 ssh:bruteforce — 2026-03-29 02:18 evidence →
86.54.42.185 credential_harvester 49% 237 2 ssh:bruteforce — 2026-03-29 01:26 evidence →
60.190.239.92 scanner 49% 213 2 ssh:bruteforce — 2026-04-02 05:23 evidence →
222.208.64.40 scanner 47% 97 2 ssh:bruteforce 40.64.208.222.broad.nc.sc.dynamic.163data.com.cn 2026-04-02 13:58 evidence →
103.82.37.117 malware_dropper 47% 69 2 ssh:bruteforce smtp.pagymogo.ink 2026-04-02 00:09 evidence →
186.56.11.2 opportunistic_bruter 47% 69 2 ssh:bruteforce — 2026-03-28 13:22 evidence →
106.51.50.23 credential_harvester 47% 66 2 ssh:bruteforce — 2026-03-29 08:31 evidence →
14.103.120.129 scanner 46% 52 2 ssh:bruteforce — 2026-04-13 15:13 evidence →
163.43.142.110 malware_dropper 46% 46 2 ssh:bruteforce — 2026-03-29 02:56 evidence →
109.73.207.89 opportunistic_bruter 46% 46 2 ssh:bruteforce — 2026-03-29 02:16 evidence →
171.243.149.203 credential_harvester 46% 317 2 ssh:bruteforce — 2026-03-28 20:28 evidence →
43.130.3.122 web_probe 42% 8 3 http:scan — 2026-05-08 07:13 evidence →
80.94.95.221 scanner 41% DROP 101 3 ssh:bruteforce — 2026-04-29 07:24 evidence →
203.83.231.93 scanner 40% 1x OSINT 20 2 ssh:bruteforce — 2026-03-28 16:22 evidence →
8.134.239.76 scanner 36% 28 2 ssh:bruteforce — 2026-05-13 02:29 evidence →
2.57.121.86 opportunistic_bruter 33% DROP 30 2 ssh:bruteforce — 2026-04-12 19:04 evidence →
114.217.149.27 scanner 31% 14 2 ssh:bruteforce — 2026-05-10 14:53 evidence →
213.21.239.4 scanner 25% 18 2 ssh:bruteforce — 2026-03-29 12:32 evidence →
134.0.106.249 scanner 24% 14 2 ssh:bruteforce — 2026-03-29 04:53 evidence →
121.40.84.227 scanner 23% 18 2 ssh:bruteforce — 2026-04-27 01:43 evidence →
103.29.70.204 scanner 22% 8 2 ssh:bruteforce — 2026-03-28 14:15 evidence →
185.73.84.45 scanner 21% 4 2 ssh:bruteforce — 2026-03-29 08:39 evidence →
38.109.112.180 scanner 21% 4 2 ssh:bruteforce — 2026-03-29 10:27 evidence →
3.134.216.108 scanner 10% 2x OSINT 185 3 http:scanssh:bruteforce scan.visionheight.com 2026-05-11 19:38 evidence →
192.155.90.220 web_probe 10% 2x OSINT 49 3 http:scanssh:bruteforce bern.scan.bufferover.run 2026-05-13 12:33 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds