IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
54 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
54 IPs
Below average
Total Events
14127
Below average by volume
Started / Ended
2026-02-27 22:10 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1090 T1105 T1572
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
223.197.248.209 credential_harvester 82% 1x OSINT 682 3 ssh:bruteforce — 2026-05-20 03:59 evidence →
187.16.96.250 credential_harvester 80% 1x OSINT 1804 3 ssh:bruteforce mvx-187-16-96-250.mundivox.com 2026-05-18 16:45 evidence →
170.79.37.82 credential_harvester 80% 1x OSINT 701 3 ssh:bruteforce — 2026-05-18 22:53 evidence →
51.158.120.121 credential_harvester 69% 2377 3 ssh:bruteforce 121-120-158-51.instances.scw.cloud 2026-05-15 10:15 evidence →
95.215.0.144 scanner 67% 2x OSINT 104 3 ftp:bruteforcessh:bruteforce scan.f6.security 2026-05-18 08:56 evidence →
101.126.155.86 scanner 66% 1x OSINT 176 2 ssh:bruteforce — 2026-05-20 21:11 evidence →
120.48.106.205 scanner 65% 1x OSINT 101 2 ssh:bruteforce — 2026-05-20 14:22 evidence →
102.88.137.213 credential_harvester 64% 1x OSINT 2502 2 ssh:bruteforce — 2026-05-17 18:22 evidence →
192.155.90.118 web_probe 60% 1x OSINT 33 3 http:scanssh:bruteforce — 2026-05-16 15:35 evidence →
211.97.69.110 opportunistic_bruter 59% 1x OSINT 50 2 ssh:bruteforce — 2026-05-18 05:29 evidence →
184.105.247.252 scanner 58% 2x OSINT 28 3 http:scanssh:bruteforce — 2026-05-03 09:57 evidence →
1.214.117.218 credential_harvester 57% 211 2 ssh:bruteforce — 2026-05-18 05:51 evidence →
43.242.203.160 credential_harvester 56% DROP1x OSINT 687 2 ssh:bruteforce — 2026-05-09 14:26 evidence →
2.57.122.190 opportunistic_bruter 56% DROP1x OSINT 115 3 ssh:bruteforce — 2026-05-14 04:02 evidence →
45.79.211.97 scanner 56% 1x OSINT 31 3 ssh:bruteforce — 2026-05-20 01:38 evidence →
210.114.22.126 credential_harvester 55% 1x OSINT 502 2 ssh:bruteforce — 2026-04-05 19:48 evidence →
45.129.185.7 credential_harvester 55% 1x OSINT 383 2 ssh:bruteforce 115461.ip-ptr.tech 2026-04-09 15:35 evidence →
205.210.31.222 web_probe 53% 1x OSINT 14 3 http:scanssh:bruteforce — 2026-05-06 10:47 evidence →
121.227.152.250 malware_dropper 53% 1x OSINT 137 2 ssh:bruteforce — 2026-05-13 16:47 evidence →
81.29.142.100 web_probe 52% 134 3 http:scanmysql:bruteforcessh:bruteforce igutic.earnningipti.co.uk 2026-05-06 23:58 evidence →
81.29.142.6 web_probe 52% 109 3 http:scanmysql:bruteforcessh:bruteforce chtlvv.rooseveraged.co.uk 2026-05-07 12:54 evidence →
36.212.227.224 scanner 52% 1x OSINT 79 2 ssh:bruteforce — 2026-04-29 21:22 evidence →
66.228.53.162 web_probe 52% 39 3 http:scan — 2026-05-18 23:08 evidence →
121.29.4.251 scanner 52% 29 2 ssh:bruteforce — 2026-05-17 05:03 evidence →
52.224.240.74 credential_harvester 51% 706 2 ssh:bruteforce — 2026-04-10 02:47 evidence →
165.154.20.214 credential_harvester 50% 392 2 ssh:bruteforce — 2026-04-20 20:06 evidence →
118.193.36.205 credential_harvester 50% 342 2 ssh:bruteforce — 2026-04-03 07:00 evidence →
203.23.199.89 credential_harvester 49% 269 2 ssh:bruteforce — 2026-04-03 15:28 evidence →
187.85.187.100 credential_harvester 48% 160 2 ssh:bruteforce — 2026-04-02 22:50 evidence →
101.33.81.73 web_probe 48% 9 3 http:scan — 2026-05-18 11:54 evidence →
14.103.64.177 scanner 48% 123 2 ssh:bruteforce — 2026-04-23 18:38 evidence →
103.179.56.44 opportunistic_bruter 47% 92 2 ssh:bruteforce ip103-179-56-44.cloudhost.web.id 2026-04-20 03:57 evidence →
202.111.173.175 scanner 47% 90 2 ssh:bruteforce — 2026-04-15 13:43 evidence →
43.134.141.244 web_probe 47% 5 3 http:scan — 2026-05-18 10:02 evidence →
83.118.24.18 opportunistic_bruter 47% 69 2 ssh:bruteforce — 2026-04-03 03:01 evidence →
14.103.124.188 scanner 47% 68 2 ssh:bruteforce — 2026-04-03 04:59 evidence →
106.12.138.190 scanner 47% 57 2 ssh:bruteforce — 2026-05-01 09:49 evidence →
66.181.171.136 credential_harvester 46% 1x OSINT 3019 2 ssh:bruteforce — 2026-04-03 17:26 evidence →
42.51.42.209 scanner 46% 39 2 ssh:bruteforce — 2026-04-03 08:31 evidence →
36.89.252.58 opportunistic_bruter 45% 1x OSINT 84 2 ssh:bruteforce — 2026-05-15 09:29 evidence →
34.78.28.28 ftp_probe 44% 8 3 ftp:bruteforcemysql:bruteforce — 2026-05-05 04:38 evidence →
171.231.181.56 credential_harvester 44% 96 2 ssh:bruteforce — 2026-04-03 09:59 evidence →
49.51.253.26 web_probe 44% 6 3 http:scan — 2026-05-16 08:21 evidence →
92.118.39.92 credential_harvester 42% DROP 9533 2 ssh:bruteforce — 2026-04-13 17:35 evidence →
14.103.84.166 scanner 40% 1x OSINT 27 2 ssh:bruteforce — 2026-05-12 08:56 evidence →
179.43.186.241 reconnaissance 37% 58 2 ssh:bruteforce — 2026-04-04 06:08 evidence →
91.224.92.50 opportunistic_bruter 34% DROP 45 2 ssh:bruteforce — 2026-04-03 04:02 evidence →
47.104.198.108 scanner 26% 74 2 ssh:bruteforce — 2026-04-25 00:14 evidence →
212.132.127.66 mysql_probe 24% 1x OSINT 2 2 mysql:bruteforce — 2026-04-02 23:43 evidence →
204.76.203.215 scanner 23% DROP 12 2 ssh:bruteforce — 2026-04-15 12:22 evidence →
185.247.95.154 scanner 21% 4 2 ssh:bruteforce — 2026-04-03 12:07 evidence →
18.116.101.220 scanner 10% 2x OSINT 357 3 http:scanssh:bruteforce scan.visionheight.com 2026-05-15 16:49 evidence →
3.130.168.2 scanner 10% 2x OSINT 343 3 http:scanssh:bruteforce scan.visionheight.com 2026-05-18 03:45 evidence →
64.62.197.32 scanner 10% 1x OSINT 28 3 http:scanssh:bruteforce scan-37a.shadowserver.org 2026-05-08 06:30 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds