IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
55 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
55 IPs
Below average
Total Events
10612
Below average by volume
Started / Ended
2026-03-01 14:10 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1090 T1105 T1572
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
5.101.64.6 scanner 64% 2x OSINT 192 3 ssh:bruteforce — 2026-05-14 11:55 evidence →
14.103.109.71 scanner 59% 1x OSINT 70 2 ssh:bruteforce — 2026-05-11 11:55 evidence →
45.162.8.14 credential_harvester 59% 1x OSINT 667 2 ssh:bruteforce — 2026-05-09 07:00 evidence →
165.154.147.69 credential_harvester 59% 1x OSINT 477 2 ssh:bruteforce — 2026-05-09 12:06 evidence →
2.57.122.197 opportunistic_bruter 58% DROP1x OSINT 75 3 ssh:bruteforce — 2026-05-09 13:03 evidence →
72.17.34.38 credential_harvester 58% 1x OSINT 431 2 ssh:bruteforce syn-072-017-034-038.biz.spectrum.com 2026-05-09 02:53 evidence →
72.253.251.7 credential_harvester 56% 1x OSINT 942 2 ssh:bruteforce — 2026-04-15 12:32 evidence →
59.36.78.66 credential_harvester 56% 1x OSINT 107 2 ssh:bruteforce — 2026-05-09 12:29 evidence →
171.244.37.97 credential_harvester 56% 1x OSINT 733 2 ssh:bruteforce — 2026-04-07 18:58 evidence →
58.98.197.137 credential_harvester 56% 1x OSINT 691 2 ssh:bruteforce — 2026-04-07 18:52 evidence →
58.222.244.226 scanner 55% 1x OSINT 626 2 ssh:bruteforce — 2026-05-05 05:29 evidence →
2.57.122.193 opportunistic_bruter 55% DROP1x OSINT 115 3 ssh:bruteforce — 2026-05-04 19:03 evidence →
2.57.122.196 opportunistic_bruter 55% DROP1x OSINT 90 3 ssh:bruteforce — 2026-05-02 01:03 evidence →
210.79.191.76 credential_harvester 53% 1x OSINT 190 2 ssh:bruteforce — 2026-03-29 09:41 evidence →
14.103.120.147 scanner 53% 1x OSINT 170 2 ssh:bruteforce — 2026-04-28 06:44 evidence →
36.138.202.60 scanner 53% 1x OSINT 168 2 ssh:bruteforce — 2026-05-07 03:52 evidence →
1.214.117.218 credential_harvester 53% 1x OSINT 165 2 ssh:bruteforce — 2026-04-03 19:14 evidence →
58.20.236.52 scanner 53% 1x OSINT 38 2 ssh:bruteforce — 2026-05-14 00:01 evidence →
103.200.25.79 credential_harvester 53% 1x OSINT 114 2 ssh:bruteforce — 2026-03-30 04:23 evidence →
103.49.238.22 credential_harvester 52% 1x OSINT 104 2 ssh:bruteforce — 2026-04-12 16:38 evidence →
182.180.57.212 credential_harvester 52% 1x OSINT 96 2 ssh:bruteforce — 2026-03-31 20:37 evidence →
103.59.94.117 opportunistic_bruter 52% 1x OSINT 69 2 ssh:bruteforce — 2026-04-02 01:39 evidence →
185.181.10.136 credential_harvester 51% 712 2 ssh:bruteforce — 2026-04-22 16:08 evidence →
14.103.115.225 scanner 51% 1x OSINT 42 2 ssh:bruteforce — 2026-04-26 18:54 evidence →
125.39.179.192 scanner 51% 1x OSINT 39 2 ssh:bruteforce no-data 2026-04-11 05:24 evidence →
165.227.119.154 credential_harvester 51% 570 2 ssh:bruteforce — 2026-04-07 14:19 evidence →
115.190.92.70 scanner 50% 1x OSINT 31 2 ssh:bruteforce — 2026-03-30 19:45 evidence →
23.111.75.127 credential_harvester 50% 415 2 ssh:bruteforce — 2026-04-18 17:25 evidence →
42.81.81.165 scanner 50% 382 2 ssh:bruteforce — 2026-04-30 16:53 evidence →
185.196.11.117 credential_harvester 49% 308 2 ssh:bruteforce inb 2026-03-31 04:24 evidence →
60.190.239.92 scanner 49% 213 2 ssh:bruteforce — 2026-04-02 05:23 evidence →
113.137.40.250 scanner 48% 138 2 ssh:bruteforce — 2026-05-07 13:57 evidence →
34.133.99.235 credential_harvester 47% 91 2 ssh:bruteforce — 2026-03-29 13:36 evidence →
20.24.100.112 credential_harvester 47% 71 2 ssh:bruteforce — 2026-04-05 12:55 evidence →
106.51.50.23 credential_harvester 47% 66 2 ssh:bruteforce — 2026-03-29 08:31 evidence →
14.103.112.105 scanner 47% 60 2 ssh:bruteforce — 2026-05-05 10:40 evidence →
85.11.167.2 mysql_bruter 47% DROP 239791 3 mysql:bruteforce — 2026-05-02 08:43 evidence →
140.249.223.130 scanner 46% 54 2 ssh:bruteforce — 2026-03-30 20:08 evidence →
94.143.142.203 credential_harvester 46% 48 2 ssh:bruteforce — 2026-03-29 21:24 evidence →
92.63.197.22 scanner 46% DROP1x OSINT 84 3 ssh:bruteforce — 2026-04-29 10:32 evidence →
101.126.82.218 opportunistic_bruter 46% 31 2 ssh:bruteforce — 2026-03-30 06:13 evidence →
116.110.150.47 credential_harvester 45% 165 2 ssh:bruteforce — 2026-03-30 06:23 evidence →
64.62.156.192 scanner 42% 2x OSINT 20 2 http:scanssh:bruteforce — 2026-04-29 06:27 evidence →
43.153.204.189 web_probe 41% 4 3 http:scan — 2026-05-08 17:26 evidence →
43.130.3.120 web_probe 39% 6 3 http:scan — 2026-05-06 13:25 evidence →
85.11.167.12 mysql_bruter 32% DROP 25925 2 mysql:bruteforce — 2026-03-31 19:05 evidence →
147.185.132.135 scanner 28% 1x OSINT 18 2 ssh:bruteforce — 2026-04-28 22:51 evidence →
180.184.52.206 credential_probe 25% 118 2 ssh:bruteforce — 2026-03-30 06:07 evidence →
213.21.239.4 scanner 25% 18 2 ssh:bruteforce — 2026-03-29 12:32 evidence →
185.133.40.94 web_probe 23% 3 2 http:scan — 2026-04-06 12:49 evidence →
201.208.209.120 scanner 22% 8 2 ssh:bruteforce — 2026-03-29 14:53 evidence →
185.73.84.45 scanner 21% 4 2 ssh:bruteforce — 2026-03-29 08:39 evidence →
151.243.11.23 scanner 21% 4 2 ssh:bruteforce — 2026-03-29 20:36 evidence →
38.109.112.180 scanner 21% 4 2 ssh:bruteforce — 2026-03-29 10:27 evidence →
192.155.90.220 web_probe 10% 1x OSINT 36 3 http:scanssh:bruteforce bern.scan.bufferover.run 2026-05-09 22:44 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds