IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
55 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
55 IPs
Below average
Total Events
23573
Below average by volume
Started / Ended
2026-02-28 14:57 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Execution
T1059.004
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1090 T1105 T1572
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
136.248.247.188 credential_harvester 78% 1x OSINT 481 3 ssh:bruteforce — 2026-05-13 09:34 evidence →
45.61.187.220 credential_harvester 74% 1x OSINT 1031 3 ssh:bruteforce node3.anycasthub.com 2026-05-10 07:41 evidence →
156.251.179.157 credential_harvester 71% 1x OSINT 861 3 ssh:bruteforce — 2026-05-02 02:40 evidence →
20.153.204.5 credential_harvester 71% 1x OSINT 741 3 ssh:bruteforce — 2026-05-05 02:13 evidence →
202.184.144.220 credential_harvester 67% 1086 3 ssh:bruteforce — 2026-05-04 18:47 evidence →
176.32.193.16 scanner 65% 3x OSINT 68 3 ssh:bruteforce — 2026-05-15 14:46 evidence →
92.27.101.99 credential_harvester 64% 1x OSINT 679 2 ssh:bruteforce host-92-27-101-99.static.as13285.net 2026-05-13 14:48 evidence →
103.67.80.61 credential_harvester 64% 1x OSINT 536 2 ssh:bruteforce — 2026-05-13 16:34 evidence →
115.190.92.70 scanner 63% 1x OSINT 33 2 ssh:bruteforce — 2026-05-15 22:11 evidence →
180.168.24.186 scanner 62% 1x OSINT 266 2 ssh:bruteforce — 2026-05-13 08:59 evidence →
120.203.25.201 scanner 62% 1x OSINT 154 2 ssh:bruteforce — 2026-05-13 21:09 evidence →
66.175.213.4 scanner 60% 48 3 http:scanssh:bruteforce — 2026-05-13 21:37 evidence →
165.154.229.58 credential_harvester 56% DROP1x OSINT 971 2 ssh:bruteforce — 2026-05-03 00:55 evidence →
190.181.25.210 credential_harvester 56% 1x OSINT 544 2 ssh:bruteforce — 2026-05-09 09:48 evidence →
95.231.249.182 credential_harvester 56% 1x OSINT 746 2 ssh:bruteforce — 2026-05-01 07:37 evidence →
66.228.53.162 web_probe 55% 35 3 http:scan — 2026-05-15 20:58 evidence →
45.10.175.77 opportunistic_bruter 54% DROP1x OSINT 50 3 ssh:bruteforce — 2026-05-09 08:07 evidence →
125.16.27.190 credential_harvester 54% 1x OSINT 288 2 ssh:bruteforce — 2026-04-16 04:37 evidence →
65.49.20.67 scanner 54% 1x OSINT 19 3 http:scanssh:bruteforce — 2026-05-06 12:25 evidence →
114.34.106.146 credential_harvester 54% 1x OSINT 208 2 ssh:bruteforce 114-34-106-146.hinet-ip.hinet.net 2026-04-24 07:24 evidence →
103.250.11.156 credential_harvester 53% 1x OSINT 162 2 ssh:bruteforce ip103-250-11-156.cloudhost.web.id 2026-04-29 02:18 evidence →
14.103.90.30 scanner 52% 1x OSINT 45 2 ssh:bruteforce — 2026-05-09 12:36 evidence →
14.103.112.109 scanner 52% 1x OSINT 71 2 ssh:bruteforce — 2026-05-07 17:06 evidence →
34.39.58.191 credential_harvester 52% 1079 2 ssh:bruteforce — 2026-05-01 06:57 evidence →
106.13.114.161 scanner 51% 1x OSINT 61 2 ssh:bruteforce — 2026-05-07 21:14 evidence →
165.154.23.29 credential_harvester 51% 878 2 ssh:bruteforce — 2026-04-24 10:40 evidence →
152.67.46.203 credential_harvester 51% 1x OSINT 48 2 ssh:bruteforce — 2026-03-31 08:20 evidence →
203.145.34.78 credential_harvester 51% 667 2 ssh:bruteforce — 2026-04-07 02:28 evidence →
103.20.223.56 credential_harvester 50% 553 2 ssh:bruteforce — 2026-04-23 05:27 evidence →
86.102.131.54 scanner 50% 1x OSINT 29 2 ssh:bruteforce — 2026-04-01 16:17 evidence →
209.97.168.111 credential_harvester 50% 467 2 ssh:bruteforce — 2026-04-04 13:57 evidence →
138.197.107.71 credential_harvester 50% 460 2 ssh:bruteforce — 2026-04-08 18:13 evidence →
103.62.152.202 credential_harvester 50% 359 2 ssh:bruteforce 202.152.62.103.in-addr.arpa.cable21.net 2026-03-31 04:35 evidence →
34.85.163.94 credential_harvester 50% 346 2 ssh:bruteforce 94.163.85.34.bc.googleusercontent.com 2026-03-31 09:03 evidence →
46.101.114.131 credential_harvester 50% 337 2 ssh:bruteforce — 2026-03-30 21:09 evidence →
185.196.11.117 credential_harvester 49% 308 2 ssh:bruteforce inb 2026-03-31 04:24 evidence →
178.217.173.50 credential_harvester 49% 287 2 ssh:bruteforce — 2026-03-31 12:22 evidence →
14.103.115.25 scanner 49% 273 2 ssh:bruteforce — 2026-05-02 16:23 evidence →
91.92.240.199 credential_harvester 49% DROP 1455 2 ssh:bruteforce — 2026-03-31 02:49 evidence →
103.67.78.217 credential_harvester 49% 225 2 ssh:bruteforce — 2026-03-31 07:13 evidence →
180.167.96.50 scanner 49% 199 2 ssh:bruteforce — 2026-05-07 09:05 evidence →
14.103.63.16 scanner 48% 155 2 ssh:bruteforce — 2026-05-05 23:14 evidence →
115.190.12.52 scanner 47% 60 2 ssh:bruteforce — 2026-03-30 22:30 evidence →
85.11.167.2 mysql_bruter 47% DROP 239791 3 mysql:bruteforce — 2026-05-02 08:43 evidence →
140.249.223.130 scanner 46% 54 2 ssh:bruteforce — 2026-03-30 20:08 evidence →
87.106.69.120 malware_dropper 46% 46 2 ssh:bruteforce — 2026-03-31 14:45 evidence →
171.243.151.26 credential_harvester 45% 268 2 ssh:bruteforce — 2026-03-30 23:30 evidence →
43.130.101.151 web_probe 41% 7 3 http:scan — 2026-05-09 15:32 evidence →
183.81.33.183 opportunistic_bruter 39% 288 2 ssh:bruteforce — 2026-04-01 16:07 evidence →
106.13.139.165 scanner 38% 127 2 ssh:bruteforce — 2026-05-03 06:27 evidence →
2.57.121.50 opportunistic_bruter 34% DROP 65 2 ssh:bruteforce — 2026-04-11 16:04 evidence →
91.224.92.50 opportunistic_bruter 34% DROP 45 2 ssh:bruteforce — 2026-04-03 04:02 evidence →
85.11.167.12 mysql_bruter 32% DROP 25925 2 mysql:bruteforce — 2026-03-31 19:05 evidence →
43.153.79.218 web_probe 25% 8 2 http:scan — 2026-05-09 05:04 evidence →
165.154.36.91 web_probe 24% 5 2 http:scan — 2026-04-26 10:57 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds