IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
72 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
72 IPs
Average
Total Events
38328
Average by volume
Started / Ended
2026-03-02 17:52 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1090 T1105 T1572
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
193.32.162.145 credential_harvester 78% DROP2x OSINT 10841 3 ssh:bruteforce — 2026-05-16 23:35 evidence →
41.181.156.205 credential_harvester 72% 1x OSINT 1079 3 ssh:bruteforce — 2026-05-10 03:56 evidence →
39.174.42.18 scanner 71% 1x OSINT 114 3 ssh:bruteforce — 2026-05-12 01:25 evidence →
51.158.120.121 credential_harvester 71% 1x OSINT 2021 3 ssh:bruteforce 121-120-158-51.instances.scw.cloud 2026-05-09 23:50 evidence →
197.225.146.23 credential_harvester 71% 1x OSINT 1364 3 ssh:bruteforce — 2026-05-02 13:56 evidence →
36.64.162.195 credential_harvester 71% 1x OSINT 1081 3 ssh:bruteforce — 2026-05-01 23:14 evidence →
81.23.173.32 credential_harvester 71% 1x OSINT 923 3 ssh:bruteforce 81-23-173-32.zgtk.ru 2026-05-06 05:35 evidence →
182.18.161.165 credential_harvester 67% 1380 3 ssh:bruteforce static-182-18-161-165.ctrls.in 2026-05-09 03:53 evidence →
173.249.50.59 credential_harvester 66% 939 3 ssh:bruteforce — 2026-04-26 11:52 evidence →
2.57.122.210 credential_harvester 66% DROP1x OSINT 8863 3 ssh:bruteforce — 2026-05-12 14:50 evidence →
114.8.146.58 credential_harvester 66% 699 3 ssh:bruteforce 114-8-146-58.resources.indosat.com 2026-04-23 06:13 evidence →
67.52.95.38 credential_harvester 65% 183 3 ssh:bruteforce — 2026-05-10 19:06 evidence →
200.141.46.25 credential_harvester 65% 319 3 ssh:bruteforce 200-141-46-25.user3p.veloxzone.com.br 2026-05-06 10:03 evidence →
59.12.160.91 credential_harvester 64% 1x OSINT 1003 2 ssh:bruteforce — 2026-05-14 06:48 evidence →
121.168.139.251 credential_harvester 64% 1x OSINT 1144 2 ssh:bruteforce — 2026-05-14 01:51 evidence →
172.235.40.131 web_probe 59% 41 3 http:scanssh:bruteforce — 2026-05-14 22:54 evidence →
157.7.113.83 credential_harvester 56% 1x OSINT 676 2 ssh:bruteforce — 2026-04-21 18:00 evidence →
59.98.148.5 credential_harvester 55% 1x OSINT 473 2 ssh:bruteforce — 2026-04-08 23:02 evidence →
183.82.111.224 credential_harvester 54% 1x OSINT 346 2 ssh:bruteforce — 2026-05-05 03:51 evidence →
5.253.59.68 malware_dropper 53% 1x OSINT 115 2 ssh:bruteforce 136226.ip-ptr.tech 2026-04-01 16:12 evidence →
223.83.114.88 scanner 52% 2x OSINT 35 3 ssh:bruteforce — 2026-05-12 09:14 evidence →
182.180.57.212 credential_harvester 52% 1x OSINT 96 2 ssh:bruteforce — 2026-03-31 20:37 evidence →
14.103.123.19 scanner 52% 1x OSINT 56 2 ssh:bruteforce — 2026-05-10 11:13 evidence →
42.51.42.209 scanner 51% 1x OSINT 39 2 ssh:bruteforce — 2026-04-03 08:31 evidence →
45.43.55.121 credential_harvester 50% 433 2 ssh:bruteforce — 2026-04-08 22:54 evidence →
178.128.92.222 credential_harvester 50% 420 2 ssh:bruteforce — 2026-04-01 07:22 evidence →
212.88.48.17 credential_harvester 50% 410 2 ssh:bruteforce — 2026-04-15 18:15 evidence →
197.243.14.52 credential_harvester 50% 1x OSINT 24 2 ssh:bruteforce — 2026-04-19 16:41 evidence →
2.57.122.197 opportunistic_bruter 50% DROP 75 3 ssh:bruteforce — 2026-05-09 13:03 evidence →
117.80.146.195 credential_harvester 50% 315 2 ssh:bruteforce — 2026-04-12 18:20 evidence →
103.67.78.18 credential_harvester 49% 293 2 ssh:bruteforce — 2026-04-02 01:44 evidence →
128.1.47.28 credential_harvester 49% 256 2 ssh:bruteforce — 2026-04-13 02:58 evidence →
186.158.200.184 credential_harvester 49% 204 2 ssh:bruteforce — 2026-04-09 10:54 evidence →
8.134.239.76 scanner 48% 34 3 ssh:bruteforce — 2026-05-14 18:52 evidence →
115.190.87.35 scanner 48% 125 2 ssh:bruteforce — 2026-04-01 02:10 evidence →
35.216.140.3 scanner 48% 21 3 ftp:bruteforcessh:bruteforce — 2026-05-01 02:35 evidence →
1.30.199.218 scanner 47% 84 2 ssh:bruteforce — 2026-04-19 08:13 evidence →
123.156.230.101 credential_harvester 47% 79 2 ssh:bruteforce — 2026-04-30 00:28 evidence →
103.143.238.207 opportunistic_bruter 47% 69 2 ssh:bruteforce — 2026-04-10 20:41 evidence →
85.11.167.2 mysql_bruter 47% DROP 239791 3 mysql:bruteforce — 2026-05-02 08:43 evidence →
14.103.50.32 scanner 46% 53 2 ssh:bruteforce — 2026-04-09 21:34 evidence →
36.134.138.153 scanner 46% 52 2 ssh:bruteforce — 2026-04-02 03:11 evidence →
189.183.7.12 credential_harvester 46% 48 2 ssh:bruteforce — 2026-03-31 21:57 evidence →
34.121.138.255 credential_harvester 46% 48 2 ssh:bruteforce — 2026-04-01 02:04 evidence →
161.35.17.41 credential_harvester 46% 48 2 ssh:bruteforce — 2026-04-01 12:36 evidence →
62.210.125.36 opportunistic_bruter 46% 46 2 ssh:bruteforce — 2026-04-01 09:04 evidence →
154.125.153.120 opportunistic_bruter 46% 46 2 ssh:bruteforce — 2026-04-01 10:11 evidence →
125.39.179.192 scanner 46% 39 2 ssh:bruteforce no-data 2026-04-11 05:24 evidence →
180.184.178.165 scanner 46% 35 2 ssh:bruteforce — 2026-04-01 09:10 evidence →
64.89.163.138 mysql_bruter 46% DROP1x OSINT 9 3 mysql:bruteforce — 2026-05-11 05:50 evidence →
171.231.178.54 credential_harvester 45% 267 2 ssh:bruteforce — 2026-04-01 08:37 evidence →
121.204.251.183 scanner 45% 26 2 ssh:bruteforce — 2026-04-01 11:23 evidence →
106.12.241.195 credential_probe 43% 1x OSINT 43 3 ssh:bruteforce — 2026-05-07 10:18 evidence →
162.62.213.165 web_probe 40% 11 3 http:scan — 2026-05-07 23:40 evidence →
64.62.156.192 scanner 39% 1x OSINT 20 2 http:scanssh:bruteforce — 2026-04-29 06:27 evidence →
43.153.48.240 web_probe 39% 4 3 http:scan — 2026-05-02 23:37 evidence →
14.236.157.41 reconnaissance 36% 40 2 ssh:bruteforce — 2026-04-01 14:15 evidence →
122.114.69.235 scanner 36% 31 2 ssh:bruteforce — 2026-05-10 01:09 evidence →
207.46.224.83 scanner 35% 22 2 ssh:bruteforce — 2026-04-01 14:12 evidence →
2.57.122.188 opportunistic_bruter 35% DROP 80 2 ssh:bruteforce — 2026-04-17 22:03 evidence →
220.178.8.154 scanner 33% 33 2 ssh:bruteforce — 2026-04-11 12:33 evidence →
205.210.31.77 scanner 28% 1x OSINT 12 2 ssh:bruteforce — 2026-04-01 16:34 evidence →
198.235.24.175 scanner 27% 1x OSINT 8 2 ssh:bruteforce — 2026-04-01 04:33 evidence →
64.89.163.92 mysql_probe 25% DROP1x OSINT 4 2 mysql:bruteforce — 2026-04-24 07:55 evidence →
135.148.120.46 web_probe 24% 5 2 http:scan — 2026-04-13 15:00 evidence →
45.156.128.128 web_probe 24% 4 2 http:scan — 2026-04-01 04:03 evidence →
159.223.145.49 scanner 23% 12 2 ssh:bruteforce — 2026-04-01 06:59 evidence →
82.129.230.191 scanner 23% 12 2 ssh:bruteforce — 2026-04-05 14:21 evidence →
164.92.175.202 web_probe 23% 2 2 http:scan — 2026-03-31 20:24 evidence →
134.199.158.149 scanner 22% 8 2 ssh:bruteforce — 2026-04-01 00:25 evidence →
167.71.22.47 scanner 22% 8 2 ssh:bruteforce — 2026-04-01 04:39 evidence →
80.82.70.133 scanner 10% DROP2x OSINT 46 3 ssh:bruteforce rnd.group-ib.com 2026-05-14 14:36 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds