IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
72 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
72 IPs
Average
Total Events
50709
Average by volume
Started / Ended
2026-03-02 17:52 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1090 T1105 T1572
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
88.147.30.59 credential_harvester 78% 1x OSINT 557 3 ssh:bruteforce 88-147-30-59.static.eolo.it 2026-05-14 06:52 evidence →
193.32.162.145 credential_harvester 78% DROP2x OSINT 10680 3 ssh:bruteforce — 2026-05-16 22:28 evidence →
41.181.156.205 credential_harvester 72% 1x OSINT 1079 3 ssh:bruteforce — 2026-05-10 03:56 evidence →
39.174.42.18 scanner 71% 1x OSINT 114 3 ssh:bruteforce — 2026-05-12 01:25 evidence →
36.64.162.195 credential_harvester 71% 1x OSINT 1081 3 ssh:bruteforce — 2026-05-01 23:14 evidence →
81.23.173.32 credential_harvester 71% 1x OSINT 923 3 ssh:bruteforce 81-23-173-32.zgtk.ru 2026-05-06 05:35 evidence →
182.18.161.165 credential_harvester 67% 1380 3 ssh:bruteforce static-182-18-161-165.ctrls.in 2026-05-09 03:53 evidence →
173.249.50.59 credential_harvester 66% 939 3 ssh:bruteforce — 2026-04-26 11:52 evidence →
114.8.146.58 credential_harvester 66% 699 3 ssh:bruteforce 114-8-146-58.resources.indosat.com 2026-04-23 06:13 evidence →
67.52.95.38 credential_harvester 65% 183 3 ssh:bruteforce — 2026-05-10 19:06 evidence →
200.141.46.25 credential_harvester 65% 319 3 ssh:bruteforce 200-141-46-25.user3p.veloxzone.com.br 2026-05-06 10:03 evidence →
121.168.139.251 credential_harvester 64% 1x OSINT 1144 2 ssh:bruteforce — 2026-05-14 01:51 evidence →
2.57.122.210 credential_harvester 61% DROP 8863 3 ssh:bruteforce — 2026-05-12 14:50 evidence →
172.235.40.131 web_probe 60% 41 3 http:scanssh:bruteforce — 2026-05-14 22:54 evidence →
172.236.228.198 web_probe 55% 1x OSINT 23 3 http:scan 172-236-228-198.ip.linodeusercontent.com 2026-05-14 22:58 evidence →
59.98.148.5 credential_harvester 55% 1x OSINT 473 2 ssh:bruteforce — 2026-04-08 23:02 evidence →
49.231.192.36 credential_harvester 55% 1x OSINT 449 2 ssh:bruteforce — 2026-04-25 20:25 evidence →
114.220.238.30 credential_harvester 54% 1x OSINT 210 2 ssh:bruteforce — 2026-04-19 08:42 evidence →
14.103.120.147 scanner 53% 1x OSINT 170 2 ssh:bruteforce — 2026-04-28 06:44 evidence →
5.253.59.68 malware_dropper 53% 1x OSINT 115 2 ssh:bruteforce 136226.ip-ptr.tech 2026-04-01 16:12 evidence →
223.83.114.88 scanner 52% 2x OSINT 35 3 ssh:bruteforce — 2026-05-12 09:14 evidence →
14.103.123.19 scanner 52% 1x OSINT 56 2 ssh:bruteforce — 2026-05-10 11:13 evidence →
182.180.57.212 credential_harvester 52% 1x OSINT 96 2 ssh:bruteforce — 2026-03-31 20:37 evidence →
103.63.25.203 credential_harvester 51% 894 2 ssh:bruteforce ip103-63-25-203.cloudhost.web.id 2026-04-25 15:30 evidence →
42.51.42.209 scanner 51% 1x OSINT 39 2 ssh:bruteforce — 2026-04-03 08:31 evidence →
45.43.55.121 credential_harvester 50% 433 2 ssh:bruteforce — 2026-04-08 22:54 evidence →
178.128.92.222 credential_harvester 50% 420 2 ssh:bruteforce — 2026-04-01 07:22 evidence →
197.243.14.52 credential_harvester 50% 1x OSINT 24 2 ssh:bruteforce — 2026-04-19 16:41 evidence →
222.167.161.198 credential_harvester 50% 340 2 ssh:bruteforce — 2026-04-23 14:00 evidence →
2.57.122.197 opportunistic_bruter 50% DROP 75 3 ssh:bruteforce — 2026-05-09 13:03 evidence →
117.80.146.195 credential_harvester 50% 315 2 ssh:bruteforce — 2026-04-12 18:20 evidence →
103.67.78.18 credential_harvester 49% 293 2 ssh:bruteforce — 2026-04-02 01:44 evidence →
128.1.47.28 credential_harvester 49% 256 2 ssh:bruteforce — 2026-04-13 02:58 evidence →
186.158.200.184 credential_harvester 49% 204 2 ssh:bruteforce — 2026-04-09 10:54 evidence →
8.134.239.76 scanner 48% 34 3 ssh:bruteforce — 2026-05-14 18:52 evidence →
115.190.87.35 scanner 48% 125 2 ssh:bruteforce — 2026-04-01 02:10 evidence →
35.216.140.3 scanner 48% 21 3 ftp:bruteforcessh:bruteforce — 2026-05-01 02:35 evidence →
1.30.199.218 scanner 47% 84 2 ssh:bruteforce — 2026-04-19 08:13 evidence →
123.156.230.101 credential_harvester 47% 79 2 ssh:bruteforce — 2026-04-30 00:28 evidence →
103.143.238.207 opportunistic_bruter 47% 69 2 ssh:bruteforce — 2026-04-10 20:41 evidence →
85.11.167.2 mysql_bruter 47% DROP 239791 3 mysql:bruteforce — 2026-05-02 08:43 evidence →
36.134.138.153 scanner 46% 52 2 ssh:bruteforce — 2026-04-02 03:11 evidence →
161.35.17.41 credential_harvester 46% 48 2 ssh:bruteforce — 2026-04-01 12:36 evidence →
189.183.7.12 credential_harvester 46% 48 2 ssh:bruteforce — 2026-03-31 21:57 evidence →
34.121.138.255 credential_harvester 46% 48 2 ssh:bruteforce — 2026-04-01 02:04 evidence →
154.125.153.120 opportunistic_bruter 46% 46 2 ssh:bruteforce — 2026-04-01 10:11 evidence →
62.210.125.36 opportunistic_bruter 46% 46 2 ssh:bruteforce — 2026-04-01 09:04 evidence →
125.39.179.192 scanner 46% 39 2 ssh:bruteforce no-data 2026-04-11 05:24 evidence →
180.184.178.165 scanner 46% 35 2 ssh:bruteforce — 2026-04-01 09:10 evidence →
64.89.163.138 mysql_bruter 46% DROP1x OSINT 9 3 mysql:bruteforce — 2026-05-11 05:50 evidence →
171.231.178.54 credential_harvester 45% 267 2 ssh:bruteforce — 2026-04-01 08:37 evidence →
121.204.251.183 scanner 45% 26 2 ssh:bruteforce — 2026-04-01 11:23 evidence →
106.12.241.195 credential_probe 43% 1x OSINT 43 3 ssh:bruteforce — 2026-05-07 10:18 evidence →
162.62.213.165 web_probe 40% 11 3 http:scan — 2026-05-07 23:40 evidence →
64.62.156.192 scanner 39% 1x OSINT 20 2 http:scanssh:bruteforce — 2026-04-29 06:27 evidence →
14.236.157.41 reconnaissance 36% 40 2 ssh:bruteforce — 2026-04-01 14:15 evidence →
122.114.69.235 scanner 36% 31 2 ssh:bruteforce — 2026-05-10 01:09 evidence →
207.46.224.83 scanner 35% 22 2 ssh:bruteforce — 2026-04-01 14:12 evidence →
2.57.122.188 opportunistic_bruter 35% DROP 80 2 ssh:bruteforce — 2026-04-17 22:03 evidence →
220.178.8.154 scanner 33% 33 2 ssh:bruteforce — 2026-04-11 12:33 evidence →
85.11.167.12 mysql_bruter 32% DROP 25925 2 mysql:bruteforce — 2026-03-31 19:05 evidence →
205.210.31.77 scanner 28% 1x OSINT 12 2 ssh:bruteforce — 2026-04-01 16:34 evidence →
198.235.24.175 scanner 27% 1x OSINT 8 2 ssh:bruteforce — 2026-04-01 04:33 evidence →
64.89.163.92 mysql_probe 25% DROP1x OSINT 4 2 mysql:bruteforce — 2026-04-24 07:55 evidence →
135.148.120.46 web_probe 24% 5 2 http:scan — 2026-04-13 15:00 evidence →
45.156.128.128 web_probe 24% 4 2 http:scan — 2026-04-01 04:03 evidence →
159.223.145.49 scanner 23% 12 2 ssh:bruteforce — 2026-04-01 06:59 evidence →
82.129.230.191 scanner 23% 12 2 ssh:bruteforce — 2026-04-05 14:21 evidence →
164.92.175.202 web_probe 23% 2 2 http:scan — 2026-03-31 20:24 evidence →
167.71.22.47 scanner 22% 8 2 ssh:bruteforce — 2026-04-01 04:39 evidence →
134.199.158.149 scanner 22% 8 2 ssh:bruteforce — 2026-04-01 00:25 evidence →
80.82.70.133 scanner 10% DROP1x OSINT 46 3 ssh:bruteforce rnd.group-ib.com 2026-05-14 14:36 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds