← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
19 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
19 IPs
Below average
Total Events
1984
Below average by volume
Started / Ended
2026-02-28 00:48 — ongoing
Member Actors
IP Address Confidence Flags Events Agents Attack Types Hostname Last Seen
102.88.137.213 67% 1x OSINT 357 2 ssh:bruteforce — 2026-04-02 20:59
51.68.226.87 67% 1x OSINT 278 2 ssh:bruteforce vps-fc0b2823.vps.ovh.net 2026-04-02 15:59
112.216.120.67 66% 1x OSINT 160 2 ssh:bruteforce — 2026-04-02 15:25
223.197.248.209 65% 1x OSINT 124 2 ssh:bruteforce — 2026-04-02 16:56
197.248.207.139 65% 1x OSINT 167 2 ssh:bruteforce — 2026-04-02 09:39
220.119.37.141 65% 1x OSINT 124 2 ssh:bruteforce — 2026-04-02 15:29
197.227.8.186 65% 1x OSINT 157 2 ssh:bruteforce — 2026-04-02 10:04
23.111.75.127 65% 1x OSINT 92 2 ssh:bruteforce — 2026-04-02 21:23
185.181.10.136 65% 1x OSINT 92 2 ssh:bruteforce — 2026-04-02 16:13
121.227.152.250 64% 1x OSINT 46 2 ssh:bruteforce — 2026-04-02 20:51
210.79.191.170 63% 1x OSINT 46 2 ssh:bruteforce — 2026-04-02 15:43
27.79.46.22 63% 1x OSINT 287 2 ssh:bruteforce — 2026-04-02 17:35
118.196.73.14 63% 1x OSINT 25 2 ssh:bruteforce — 2026-04-02 19:14
121.29.4.251 62% 1x OSINT 25 2 ssh:bruteforce — 2026-04-02 16:13
114.220.75.156 49% 2x OSINT 14 2 ssh:bruteforce — 2026-04-02 12:34
192.155.90.220 47% 1x OSINT 14 2 http:scanssh:bruteforce bern.scan.bufferover.run 2026-04-02 19:58
106.75.231.80 45% 2 1 ssh:bruteforce — 2026-04-02 18:47
172.236.228.38 40% 1x OSINT 18 2 ssh:bruteforce — 2026-04-02 13:35
34.76.59.29 39% 2 2 ftp:bruteforcemysql:bruteforce — 2026-04-02 15:21
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds