IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
54 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
54 IPs
Below average
Total Events
17561
Below average by volume
Started / Ended
2026-03-11 01:50 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1090 T1105 T1572
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
121.168.139.251 credential_harvester 84% 1x OSINT 1393 3 ssh:bruteforce — 2026-05-20 18:33 evidence →
223.197.248.209 credential_harvester 82% 1x OSINT 682 3 ssh:bruteforce — 2026-05-20 03:59 evidence →
220.119.37.141 credential_harvester 80% 1x OSINT 193 3 ssh:bruteforce — 2026-05-20 06:43 evidence →
157.7.113.83 credential_harvester 80% 1x OSINT 1119 3 ssh:bruteforce — 2026-05-18 16:44 evidence →
197.227.8.186 credential_harvester 80% 1x OSINT 902 3 ssh:bruteforce — 2026-05-18 16:57 evidence →
67.52.95.38 credential_harvester 68% 1x OSINT 183 3 ssh:bruteforce — 2026-05-10 19:06 evidence →
182.253.156.173 credential_harvester 64% 224 3 ssh:bruteforce — 2026-04-26 06:02 evidence →
51.68.226.87 credential_harvester 62% 1x OSINT 642 2 ssh:bruteforce vps-fc0b2823.vps.ovh.net 2026-05-17 15:04 evidence →
172.236.228.38 web_probe 62% 51 3 http:scanssh:bruteforce — 2026-05-20 01:18 evidence →
173.212.228.191 credential_harvester 62% 1x OSINT 878 2 ssh:bruteforce — 2026-05-17 02:26 evidence →
172.236.228.115 web_probe 62% 1x OSINT 51 3 http:scanssh:bruteforce — 2026-05-17 07:12 evidence →
2.57.122.210 credential_harvester 61% DROP1x OSINT 8863 3 ssh:bruteforce — 2026-05-12 14:50 evidence →
35.216.201.9 mysql_bruter 60% 32 3 ftp:bruteforcemysql:bruteforcessh:bruteforce — 2026-05-20 04:38 evidence →
72.14.178.148 scanner 57% 1x OSINT 44 3 ssh:bruteforce — 2026-05-20 13:32 evidence →
117.6.44.221 credential_harvester 56% 1x OSINT 1024 2 ssh:bruteforce — 2026-05-07 08:01 evidence →
103.103.245.61 credential_harvester 56% 1x OSINT 1006 2 ssh:bruteforce — 2026-04-19 08:48 evidence →
131.161.249.165 credential_harvester 55% 1x OSINT 564 2 ssh:bruteforce — 2026-04-27 17:19 evidence →
223.83.114.88 scanner 55% 2x OSINT 41 3 ssh:bruteforce — 2026-05-17 17:30 evidence →
2.57.122.193 opportunistic_bruter 55% DROP1x OSINT 120 3 ssh:bruteforce — 2026-05-13 16:03 evidence →
183.82.111.224 credential_harvester 54% 1x OSINT 346 2 ssh:bruteforce — 2026-05-05 03:51 evidence →
36.26.82.246 scanner 53% 1x OSINT 137 2 ssh:bruteforce — 2026-04-12 13:44 evidence →
191.97.12.90 credential_harvester 53% 1x OSINT 119 2 ssh:bruteforce — 2026-04-13 22:18 evidence →
43.131.45.213 web_probe 52% 10 3 http:scan — 2026-05-20 14:18 evidence →
121.29.4.251 scanner 52% 29 2 ssh:bruteforce — 2026-05-17 05:03 evidence →
14.103.50.32 scanner 51% 1x OSINT 53 2 ssh:bruteforce — 2026-04-09 21:34 evidence →
118.193.33.81 credential_harvester 51% 807 2 ssh:bruteforce — 2026-05-02 08:32 evidence →
210.79.191.170 credential_harvester 51% 625 2 ssh:bruteforce — 2026-04-14 18:11 evidence →
14.103.46.177 scanner 50% 1x OSINT 31 2 ssh:bruteforce — 2026-04-26 05:14 evidence →
59.98.148.5 credential_harvester 50% 473 2 ssh:bruteforce — 2026-04-08 23:02 evidence →
164.90.157.6 credential_harvester 50% 445 2 ssh:bruteforce — 2026-04-08 12:01 evidence →
45.43.55.121 credential_harvester 50% 433 2 ssh:bruteforce — 2026-04-08 22:54 evidence →
117.80.146.195 credential_harvester 50% 315 2 ssh:bruteforce — 2026-04-12 18:20 evidence →
103.67.78.18 credential_harvester 49% 293 2 ssh:bruteforce — 2026-04-02 01:44 evidence →
128.1.47.28 credential_harvester 49% 256 2 ssh:bruteforce — 2026-04-13 02:58 evidence →
14.195.83.210 credential_harvester 49% 183 2 ssh:bruteforce mail.tataidc.com 2026-04-02 15:21 evidence →
112.216.120.67 malware_dropper 48% 160 2 ssh:bruteforce — 2026-04-02 15:25 evidence →
14.103.112.1 scanner 48% 116 2 ssh:bruteforce — 2026-04-16 09:50 evidence →
118.196.73.184 scanner 47% 72 2 ssh:bruteforce — 2026-04-02 03:13 evidence →
60.167.166.161 scanner 47% 66 2 ssh:bruteforce — 2026-04-08 17:41 evidence →
34.76.35.74 mysql_bruter 47% 10 3 ftp:bruteforcemysql:bruteforce — 2026-05-12 14:51 evidence →
106.75.231.80 scanner 46% 49 2 ssh:bruteforce — 2026-04-22 09:20 evidence →
45.79.5.11 scanner 46% 1x OSINT 29 3 ssh:bruteforce — 2026-05-15 00:33 evidence →
42.51.42.209 scanner 46% 39 2 ssh:bruteforce — 2026-04-03 08:31 evidence →
27.79.46.22 credential_harvester 46% 287 2 ssh:bruteforce — 2026-04-02 17:35 evidence →
66.240.192.82 scanner 44% 1x OSINT 28 3 ssh:bruteforce — 2026-05-09 03:59 evidence →
34.78.28.28 ftp_probe 44% 8 3 ftp:bruteforcemysql:bruteforce — 2026-05-05 04:38 evidence →
49.51.253.26 web_probe 44% 6 3 http:scan — 2026-05-16 08:21 evidence →
92.118.39.92 credential_harvester 42% DROP 9533 2 ssh:bruteforce — 2026-04-13 17:35 evidence →
2.57.122.188 opportunistic_bruter 35% DROP 80 2 ssh:bruteforce — 2026-04-17 22:03 evidence →
116.176.62.179 reconnaissance 34% 13 2 ssh:bruteforce — 2026-04-02 07:43 evidence →
34.76.59.29 mysql_probe 29% 7 2 ftp:bruteforcemysql:bruteforce — 2026-05-08 15:59 evidence →
114.220.75.156 scanner 26% 39 2 ssh:bruteforce — 2026-05-08 10:37 evidence →
135.148.120.46 web_probe 24% 5 2 http:scan — 2026-04-13 15:00 evidence →
82.129.230.191 scanner 23% 12 2 ssh:bruteforce — 2026-04-05 14:21 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds