IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
35 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
35 IPs
Below average
Total Events
16546
Below average by volume
Started / Ended
2026-02-22 17:05 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1090 T1105 T1572
Exfiltration
T1048
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
213.209.159.159 credential_harvester 63% DROP 23166 3 ssh:bruteforce — 2026-05-01 11:26 evidence →
172.234.217.129 web_probe 60% 43 3 http:scanssh:bruteforce 172-234-217-129.ip.linodeusercontent.com 2026-05-11 23:48 evidence →
14.103.120.138 scanner 59% 1x OSINT 191 2 ssh:bruteforce — 2026-05-09 12:33 evidence →
172.235.40.131 web_probe 59% 40 3 http:scanssh:bruteforce — 2026-05-11 06:06 evidence →
59.36.78.66 credential_harvester 58% 1x OSINT 107 2 ssh:bruteforce — 2026-05-09 12:29 evidence →
72.253.251.7 credential_harvester 56% 1x OSINT 942 2 ssh:bruteforce — 2026-04-15 12:32 evidence →
168.167.72.132 credential_harvester 56% 1x OSINT 936 2 ssh:bruteforce — 2026-05-01 11:48 evidence →
202.165.15.132 credential_harvester 56% 1x OSINT 702 2 ssh:bruteforce — 2026-04-19 20:31 evidence →
103.237.144.204 credential_harvester 55% 1x OSINT 533 2 ssh:bruteforce — 2026-05-04 10:20 evidence →
103.200.25.79 credential_harvester 53% 1x OSINT 114 2 ssh:bruteforce — 2026-03-30 04:23 evidence →
106.12.138.190 scanner 51% 1x OSINT 57 2 ssh:bruteforce — 2026-05-01 09:49 evidence →
152.32.174.67 credential_harvester 51% 562 2 ssh:bruteforce — 2026-04-12 12:05 evidence →
178.128.92.222 credential_harvester 50% 420 2 ssh:bruteforce — 2026-04-01 07:22 evidence →
103.62.152.202 credential_harvester 50% 359 2 ssh:bruteforce 202.152.62.103.in-addr.arpa.cable21.net 2026-03-31 04:35 evidence →
185.196.11.117 credential_harvester 49% 308 2 ssh:bruteforce inb 2026-03-31 04:24 evidence →
45.195.221.26 credential_harvester 49% 271 2 ssh:bruteforce — 2026-04-20 03:49 evidence →
103.82.27.19 reconnaissance 49% 2651 2 ssh:bruteforce — 2026-03-29 02:18 evidence →
60.190.239.92 scanner 49% 213 2 ssh:bruteforce — 2026-04-02 05:23 evidence →
34.133.99.235 credential_harvester 47% 91 2 ssh:bruteforce — 2026-03-29 13:36 evidence →
20.24.100.112 credential_harvester 47% 71 2 ssh:bruteforce — 2026-04-05 12:55 evidence →
103.82.37.117 malware_dropper 47% 69 2 ssh:bruteforce smtp.pagymogo.ink 2026-04-02 00:09 evidence →
106.51.50.23 credential_harvester 47% 66 2 ssh:bruteforce — 2026-03-29 08:31 evidence →
109.73.207.89 opportunistic_bruter 46% 46 2 ssh:bruteforce — 2026-03-29 02:16 evidence →
163.43.142.110 malware_dropper 46% 46 2 ssh:bruteforce — 2026-03-29 02:56 evidence →
171.243.149.203 credential_harvester 46% 317 2 ssh:bruteforce — 2026-03-28 20:28 evidence →
203.83.231.93 scanner 40% 1x OSINT 20 2 ssh:bruteforce — 2026-03-28 16:22 evidence →
43.130.3.120 web_probe 39% 6 3 http:scan — 2026-05-06 13:25 evidence →
2.57.121.86 opportunistic_bruter 33% DROP 30 2 ssh:bruteforce — 2026-04-12 19:04 evidence →
114.217.149.27 scanner 31% 14 2 ssh:bruteforce — 2026-05-10 14:53 evidence →
134.0.106.249 scanner 24% 14 2 ssh:bruteforce — 2026-03-29 04:53 evidence →
121.40.84.227 scanner 23% 18 2 ssh:bruteforce — 2026-04-27 01:43 evidence →
103.29.70.204 scanner 22% 8 2 ssh:bruteforce — 2026-03-28 14:15 evidence →
38.109.112.180 scanner 21% 4 2 ssh:bruteforce — 2026-03-29 10:27 evidence →
185.73.84.45 scanner 21% 4 2 ssh:bruteforce — 2026-03-29 08:39 evidence →
192.155.90.220 web_probe 10% 2x OSINT 49 3 http:scanssh:bruteforce bern.scan.bufferover.run 2026-05-13 12:33 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds