IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
56 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
56 IPs
Below average
Total Events
11523
Below average by volume
Started / Ended
2026-03-01 14:10 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1090 T1105 T1572
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
196.0.120.211 credential_harvester 76% 1x OSINT 1305 3 ssh:bruteforce xen2.utclonline.co.ug 2026-05-09 20:45 evidence →
223.17.5.126 credential_harvester 71% 1x OSINT 549 3 ssh:bruteforce 126-5-17-223-on-nets.com 2026-05-08 05:06 evidence →
2.57.122.195 opportunistic_bruter 62% DROP1x OSINT 165 3 ssh:bruteforce — 2026-05-11 01:03 evidence →
154.70.102.114 credential_harvester 60% 1x OSINT 653 2 ssh:bruteforce host-154.70.102.114.mtn.cm 2026-05-10 04:16 evidence →
14.103.109.71 scanner 59% 1x OSINT 70 2 ssh:bruteforce — 2026-05-11 11:55 evidence →
45.162.8.14 credential_harvester 59% 1x OSINT 667 2 ssh:bruteforce — 2026-05-09 07:00 evidence →
165.154.147.69 credential_harvester 59% 1x OSINT 477 2 ssh:bruteforce — 2026-05-09 12:06 evidence →
172.236.119.165 web_probe 58% 43 3 http:scanssh:bruteforce — 2026-05-11 14:37 evidence →
72.17.34.38 credential_harvester 58% 1x OSINT 431 2 ssh:bruteforce syn-072-017-034-038.biz.spectrum.com 2026-05-09 02:53 evidence →
72.253.251.7 credential_harvester 56% 1x OSINT 942 2 ssh:bruteforce — 2026-04-15 12:32 evidence →
201.249.192.30 credential_harvester 56% 1x OSINT 931 2 ssh:bruteforce — 2026-05-05 09:02 evidence →
59.36.78.66 credential_harvester 56% 1x OSINT 107 2 ssh:bruteforce — 2026-05-09 12:29 evidence →
220.118.173.234 credential_harvester 56% 1x OSINT 710 2 ssh:bruteforce — 2026-05-07 17:08 evidence →
171.244.37.97 credential_harvester 56% 1x OSINT 733 2 ssh:bruteforce — 2026-04-07 18:58 evidence →
58.98.197.137 credential_harvester 56% 1x OSINT 691 2 ssh:bruteforce — 2026-04-07 18:52 evidence →
58.222.244.226 scanner 55% 1x OSINT 626 2 ssh:bruteforce — 2026-05-05 05:29 evidence →
213.6.203.226 credential_harvester 55% 1x OSINT 392 2 ssh:bruteforce — 2026-04-29 15:58 evidence →
2.57.122.196 opportunistic_bruter 55% DROP1x OSINT 90 3 ssh:bruteforce — 2026-05-02 01:03 evidence →
210.79.191.76 credential_harvester 53% 1x OSINT 190 2 ssh:bruteforce — 2026-03-29 09:41 evidence →
14.103.120.147 scanner 53% 1x OSINT 170 2 ssh:bruteforce — 2026-04-28 06:44 evidence →
36.138.202.60 scanner 53% 1x OSINT 168 2 ssh:bruteforce — 2026-05-07 03:52 evidence →
1.214.117.218 credential_harvester 53% 1x OSINT 165 2 ssh:bruteforce — 2026-04-03 19:14 evidence →
58.20.236.52 scanner 53% 1x OSINT 38 2 ssh:bruteforce — 2026-05-14 00:01 evidence →
103.49.238.22 credential_harvester 52% 1x OSINT 104 2 ssh:bruteforce — 2026-04-12 16:38 evidence →
182.180.57.212 credential_harvester 52% 1x OSINT 96 2 ssh:bruteforce — 2026-03-31 20:37 evidence →
103.59.94.117 opportunistic_bruter 52% 1x OSINT 69 2 ssh:bruteforce — 2026-04-02 01:39 evidence →
14.103.115.225 scanner 51% 1x OSINT 42 2 ssh:bruteforce — 2026-04-26 18:54 evidence →
125.39.179.192 scanner 51% 1x OSINT 39 2 ssh:bruteforce no-data 2026-04-11 05:24 evidence →
115.190.92.70 scanner 50% 1x OSINT 31 2 ssh:bruteforce — 2026-03-30 19:45 evidence →
45.40.57.41 credential_harvester 50% 452 2 ssh:bruteforce — 2026-04-07 01:01 evidence →
23.111.75.127 credential_harvester 50% 415 2 ssh:bruteforce — 2026-04-18 17:25 evidence →
185.196.11.117 credential_harvester 49% 308 2 ssh:bruteforce inb 2026-03-31 04:24 evidence →
177.36.220.22 credential_harvester 49% 251 2 ssh:bruteforce — 2026-04-04 01:20 evidence →
67.81.35.26 credential_harvester 48% 160 2 ssh:bruteforce ool-4351231a.dyn.optonline.net 2026-03-29 18:00 evidence →
34.133.99.235 credential_harvester 47% 91 2 ssh:bruteforce — 2026-03-29 13:36 evidence →
20.24.100.112 credential_harvester 47% 71 2 ssh:bruteforce — 2026-04-05 12:55 evidence →
106.51.50.23 credential_harvester 47% 66 2 ssh:bruteforce — 2026-03-29 08:31 evidence →
14.103.112.105 scanner 47% 60 2 ssh:bruteforce — 2026-05-05 10:40 evidence →
85.11.167.2 mysql_bruter 47% DROP 239791 3 mysql:bruteforce — 2026-05-02 08:43 evidence →
140.249.223.130 scanner 46% 54 2 ssh:bruteforce — 2026-03-30 20:08 evidence →
94.143.142.203 credential_harvester 46% 48 2 ssh:bruteforce — 2026-03-29 21:24 evidence →
43.163.206.70 web_probe 46% 13 3 http:scan — 2026-05-10 16:41 evidence →
92.63.197.22 scanner 46% DROP1x OSINT 84 3 ssh:bruteforce — 2026-04-29 10:32 evidence →
101.126.82.218 opportunistic_bruter 46% 31 2 ssh:bruteforce — 2026-03-30 06:13 evidence →
116.110.150.47 credential_harvester 45% 165 2 ssh:bruteforce — 2026-03-30 06:23 evidence →
43.153.204.189 web_probe 41% 4 3 http:scan — 2026-05-08 17:26 evidence →
43.130.3.120 web_probe 39% 6 3 http:scan — 2026-05-06 13:25 evidence →
85.11.167.12 mysql_bruter 32% DROP 25925 2 mysql:bruteforce — 2026-03-31 19:05 evidence →
147.185.132.135 scanner 28% 1x OSINT 18 2 ssh:bruteforce — 2026-04-28 22:51 evidence →
213.21.239.4 scanner 25% 18 2 ssh:bruteforce — 2026-03-29 12:32 evidence →
185.133.40.94 web_probe 23% 3 2 http:scan — 2026-04-06 12:49 evidence →
201.208.209.120 scanner 22% 8 2 ssh:bruteforce — 2026-03-29 14:53 evidence →
185.73.84.45 scanner 21% 4 2 ssh:bruteforce — 2026-03-29 08:39 evidence →
151.243.11.23 scanner 21% 4 2 ssh:bruteforce — 2026-03-29 20:36 evidence →
38.109.112.180 scanner 21% 4 2 ssh:bruteforce — 2026-03-29 10:27 evidence →
192.155.90.220 web_probe 10% 1x OSINT 36 3 http:scanssh:bruteforce bern.scan.bufferover.run 2026-05-09 22:44 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds