IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
33 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
33 IPs
Below average
Total Events
13791
Below average by volume
Started / Ended
2026-03-24 12:27 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1090 T1105 T1572
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
196.0.120.211 credential_harvester 76% 1x OSINT 1305 3 ssh:bruteforce xen2.utclonline.co.ug 2026-05-09 20:45 evidence →
213.209.159.159 credential_harvester 63% DROP 23166 3 ssh:bruteforce — 2026-05-01 11:26 evidence →
2.57.122.194 opportunistic_bruter 62% DROP1x OSINT 170 3 ssh:bruteforce — 2026-05-10 10:02 evidence →
165.154.147.69 credential_harvester 60% 1x OSINT 477 2 ssh:bruteforce — 2026-05-09 12:06 evidence →
72.253.251.7 credential_harvester 56% 1x OSINT 942 2 ssh:bruteforce — 2026-04-15 12:32 evidence →
201.249.192.30 credential_harvester 56% 1x OSINT 931 2 ssh:bruteforce — 2026-05-05 09:02 evidence →
213.6.203.226 credential_harvester 55% 1x OSINT 392 2 ssh:bruteforce — 2026-04-29 15:58 evidence →
2.57.122.196 opportunistic_bruter 55% DROP1x OSINT 90 3 ssh:bruteforce — 2026-05-02 01:03 evidence →
58.20.236.52 scanner 54% 1x OSINT 38 2 ssh:bruteforce — 2026-05-14 00:01 evidence →
103.49.238.22 credential_harvester 52% 1x OSINT 104 2 ssh:bruteforce — 2026-04-12 16:38 evidence →
182.180.57.212 credential_harvester 52% 1x OSINT 96 2 ssh:bruteforce — 2026-03-31 20:37 evidence →
185.181.10.136 credential_harvester 51% 712 2 ssh:bruteforce — 2026-04-22 16:08 evidence →
125.39.179.192 scanner 51% 1x OSINT 39 2 ssh:bruteforce no-data 2026-04-11 05:24 evidence →
45.40.57.41 credential_harvester 50% 452 2 ssh:bruteforce — 2026-04-07 01:01 evidence →
185.196.11.117 credential_harvester 49% 308 2 ssh:bruteforce inb 2026-03-31 04:24 evidence →
182.52.109.76 credential_harvester 49% 296 2 ssh:bruteforce — 2026-04-02 00:16 evidence →
177.36.220.22 credential_harvester 49% 251 2 ssh:bruteforce — 2026-04-04 01:20 evidence →
67.81.35.26 credential_harvester 48% 160 2 ssh:bruteforce ool-4351231a.dyn.optonline.net 2026-03-29 18:00 evidence →
34.133.99.235 credential_harvester 47% 91 2 ssh:bruteforce — 2026-03-29 13:36 evidence →
20.24.100.112 credential_harvester 47% 71 2 ssh:bruteforce — 2026-04-05 12:55 evidence →
14.103.112.105 scanner 47% 60 2 ssh:bruteforce — 2026-05-05 10:40 evidence →
14.103.120.129 scanner 46% 52 2 ssh:bruteforce — 2026-04-13 15:13 evidence →
94.143.142.203 credential_harvester 46% 48 2 ssh:bruteforce — 2026-03-29 21:24 evidence →
92.63.197.22 scanner 46% DROP1x OSINT 84 3 ssh:bruteforce — 2026-04-29 10:32 evidence →
43.153.204.189 web_probe 42% 4 3 http:scan — 2026-05-08 17:26 evidence →
43.130.3.120 web_probe 39% 6 3 http:scan — 2026-05-06 13:25 evidence →
2.57.121.50 opportunistic_bruter 34% DROP 65 2 ssh:bruteforce — 2026-04-11 16:04 evidence →
147.185.132.135 scanner 28% 1x OSINT 18 2 ssh:bruteforce — 2026-04-28 22:51 evidence →
213.21.239.4 scanner 25% 18 2 ssh:bruteforce — 2026-03-29 12:32 evidence →
185.133.40.94 web_probe 23% 3 2 http:scan — 2026-04-06 12:49 evidence →
201.208.209.120 scanner 22% 8 2 ssh:bruteforce — 2026-03-29 14:53 evidence →
151.243.11.23 scanner 21% 4 2 ssh:bruteforce — 2026-03-29 20:36 evidence →
38.109.112.180 scanner 21% 4 2 ssh:bruteforce — 2026-03-29 10:27 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds