IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
56 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
56 IPs
Below average
Total Events
42024
Average by volume
Started / Ended
2026-02-23 12:50 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Execution
T1059.004
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1090 T1105 T1572
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
223.197.248.209 credential_harvester 82% 1x OSINT 682 3 ssh:bruteforce — 2026-05-20 03:59 evidence →
220.119.37.141 credential_harvester 80% 1x OSINT 193 3 ssh:bruteforce — 2026-05-20 06:43 evidence →
197.227.8.186 credential_harvester 80% 1x OSINT 902 3 ssh:bruteforce — 2026-05-18 16:57 evidence →
67.52.95.38 credential_harvester 68% 1x OSINT 183 3 ssh:bruteforce — 2026-05-10 19:06 evidence →
101.126.155.86 scanner 66% 1x OSINT 176 2 ssh:bruteforce — 2026-05-20 21:11 evidence →
182.253.156.173 credential_harvester 64% 224 3 ssh:bruteforce — 2026-04-26 06:02 evidence →
172.236.228.38 web_probe 62% 51 3 http:scanssh:bruteforce — 2026-05-20 01:18 evidence →
173.212.228.191 credential_harvester 62% 1x OSINT 878 2 ssh:bruteforce — 2026-05-17 02:26 evidence →
172.236.228.115 web_probe 62% 1x OSINT 51 3 http:scanssh:bruteforce — 2026-05-17 07:12 evidence →
35.216.201.9 mysql_bruter 60% 32 3 ftp:bruteforcemysql:bruteforcessh:bruteforce — 2026-05-20 04:38 evidence →
85.11.167.2 mysql_bruter 59% DROP 242488 3 mysql:bruteforce — 2026-05-20 14:46 evidence →
72.14.178.148 scanner 57% 1x OSINT 44 3 ssh:bruteforce — 2026-05-20 13:32 evidence →
223.83.114.88 scanner 55% 2x OSINT 41 3 ssh:bruteforce — 2026-05-17 17:30 evidence →
45.129.185.7 credential_harvester 55% 1x OSINT 383 2 ssh:bruteforce 115461.ip-ptr.tech 2026-04-09 15:35 evidence →
121.227.152.250 malware_dropper 53% 1x OSINT 137 2 ssh:bruteforce — 2026-05-13 16:47 evidence →
36.26.82.246 scanner 53% 1x OSINT 137 2 ssh:bruteforce — 2026-04-12 13:44 evidence →
43.131.45.213 web_probe 52% 10 3 http:scan — 2026-05-20 14:18 evidence →
81.29.142.100 web_probe 52% 134 3 http:scanmysql:bruteforcessh:bruteforce igutic.earnningipti.co.uk 2026-05-06 23:58 evidence →
121.29.4.251 scanner 52% 29 2 ssh:bruteforce — 2026-05-17 05:03 evidence →
14.103.50.32 scanner 51% 1x OSINT 53 2 ssh:bruteforce — 2026-04-09 21:34 evidence →
185.181.10.136 credential_harvester 51% 712 2 ssh:bruteforce — 2026-04-22 16:08 evidence →
210.79.191.170 credential_harvester 51% 625 2 ssh:bruteforce — 2026-04-14 18:11 evidence →
14.103.46.177 scanner 50% 1x OSINT 31 2 ssh:bruteforce — 2026-04-26 05:14 evidence →
59.98.148.5 credential_harvester 50% 473 2 ssh:bruteforce — 2026-04-08 23:02 evidence →
164.90.157.6 credential_harvester 50% 445 2 ssh:bruteforce — 2026-04-08 12:01 evidence →
45.43.55.121 credential_harvester 50% 433 2 ssh:bruteforce — 2026-04-08 22:54 evidence →
23.111.75.127 credential_harvester 50% 415 2 ssh:bruteforce — 2026-04-18 17:25 evidence →
165.154.20.214 credential_harvester 50% 392 2 ssh:bruteforce — 2026-04-20 20:06 evidence →
103.80.87.39 credential_harvester 49% 304 2 ssh:bruteforce — 2026-04-14 15:40 evidence →
103.67.78.18 credential_harvester 49% 293 2 ssh:bruteforce — 2026-04-02 01:44 evidence →
91.92.243.116 credential_harvester 49% DROP 2596 2 ssh:bruteforce — 2026-04-02 11:49 evidence →
60.190.239.92 scanner 49% 213 2 ssh:bruteforce — 2026-04-02 05:23 evidence →
180.167.96.50 scanner 49% 199 2 ssh:bruteforce — 2026-05-07 09:05 evidence →
112.216.120.67 malware_dropper 48% 160 2 ssh:bruteforce — 2026-04-02 15:25 evidence →
202.111.173.175 scanner 47% 90 2 ssh:bruteforce — 2026-04-15 13:43 evidence →
43.134.141.244 web_probe 47% 5 3 http:scan — 2026-05-18 10:02 evidence →
118.196.73.184 scanner 47% 72 2 ssh:bruteforce — 2026-04-02 03:13 evidence →
103.59.94.117 opportunistic_bruter 47% 69 2 ssh:bruteforce — 2026-04-02 01:39 evidence →
103.82.37.117 malware_dropper 47% 69 2 ssh:bruteforce smtp.pagymogo.ink 2026-04-02 00:09 evidence →
118.196.73.14 scanner 47% 62 2 ssh:bruteforce — 2026-04-16 13:45 evidence →
34.76.35.74 mysql_bruter 47% 10 3 ftp:bruteforcemysql:bruteforce — 2026-05-12 14:51 evidence →
106.12.138.190 scanner 47% 57 2 ssh:bruteforce — 2026-05-01 09:49 evidence →
36.134.138.153 scanner 46% 52 2 ssh:bruteforce — 2026-04-02 03:11 evidence →
106.75.231.80 scanner 46% 49 2 ssh:bruteforce — 2026-04-22 09:20 evidence →
45.79.5.11 scanner 46% 1x OSINT 29 3 ssh:bruteforce — 2026-05-15 00:33 evidence →
27.79.46.22 credential_harvester 46% 287 2 ssh:bruteforce — 2026-04-02 17:35 evidence →
34.78.28.28 ftp_probe 44% 8 3 ftp:bruteforcemysql:bruteforce — 2026-05-05 04:38 evidence →
49.51.253.26 web_probe 44% 6 3 http:scan — 2026-05-16 08:21 evidence →
2.57.122.188 opportunistic_bruter 35% DROP 80 2 ssh:bruteforce — 2026-04-17 22:03 evidence →
116.176.62.179 reconnaissance 34% 13 2 ssh:bruteforce — 2026-04-02 07:43 evidence →
34.76.59.29 mysql_probe 29% 7 2 ftp:bruteforcemysql:bruteforce — 2026-05-08 15:59 evidence →
114.220.75.156 scanner 26% 39 2 ssh:bruteforce — 2026-05-08 10:37 evidence →
135.148.120.46 web_probe 24% 5 2 http:scan — 2026-04-13 15:00 evidence →
82.129.230.191 scanner 23% 12 2 ssh:bruteforce — 2026-04-05 14:21 evidence →
192.155.90.220 web_probe 10% 1x OSINT 50 3 http:scanssh:bruteforce bern.scan.bufferover.run 2026-05-18 17:49 evidence →
172.104.11.34 web_probe 10% 2x OSINT 37 3 http:scanssh:bruteforce edinburgh.scan.bufferover.run 2026-05-18 06:33 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds