IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
33 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
33 IPs
Below average
Total Events
4243
Below average by volume
Started / Ended
2026-02-23 12:50 — ongoing
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
210.183.21.53 credential_harvester 64% 704 2 ssh:bruteforce — 2026-04-12 11:43 evidence →
118.193.33.3 credential_harvester 63% 802 2 ssh:bruteforce — 2026-04-12 02:45 evidence →
110.14.190.217 credential_harvester 63% 491 2 ssh:bruteforce — 2026-04-12 11:44 evidence →
89.190.156.34 credential_harvester 60% 1x OSINT 23 2 ssh:bruteforce — 2026-04-12 12:53 evidence →
115.190.106.110 scanner 60% 69 2 ssh:bruteforce — 2026-04-12 12:15 evidence →
14.103.249.172 scanner 59% 60 2 ssh:bruteforce — 2026-04-12 09:43 evidence →
43.245.143.215 opportunistic_bruter 59% 46 2 ssh:bruteforce — 2026-04-11 22:40 evidence →
72.253.251.7 credential_harvester 55% 650 2 ssh:bruteforce — 2026-04-07 18:57 evidence →
102.210.149.105 credential_harvester 54% 513 2 ssh:bruteforce — 2026-04-07 12:13 evidence →
123.60.136.40 credential_harvester 51% 111 1 ssh:bruteforce — 2026-04-12 12:34 evidence →
37.120.213.13 credential_harvester 51% VPN1x OSINT 60 2 ssh:bruteforce — 2026-04-12 07:50 evidence →
81.29.142.100 http:scan 50% 1x OSINT 81 2 http:scanmysql:bruteforcessh:bruteforce igutic.earnningipti.co.uk 2026-04-12 14:52 evidence →
172.236.228.218 scanner 49% 1x OSINT 24 2 http:scanssh:bruteforce — 2026-04-12 07:27 evidence →
2.57.122.192 opportunistic_bruter 47% DROP 50 2 ssh:bruteforce — 2026-04-12 13:02 evidence →
2.57.121.69 opportunistic_bruter 46% DROP 45 2 ssh:bruteforce — 2026-04-12 10:02 evidence →
2.57.121.86 opportunistic_bruter 45% DROP 25 2 ssh:bruteforce — 2026-04-12 10:02 evidence →
172.236.228.208 scanner 44% 1x OSINT 42 2 http:scanssh:bruteforce 172-236-228-208.ip.linodeusercontent.com 2026-04-09 04:55 evidence →
165.227.139.253 scanner 42% 5 2 http:scanssh:bruteforce — 2026-04-12 11:43 evidence →
110.166.87.119 scanner 41% 34 2 ssh:bruteforce — 2026-04-12 03:05 evidence →
142.248.80.38 http:scan 41% 2x OSINT 5 2 http:scan — 2026-04-12 11:46 evidence →
172.236.228.202 http:scan 41% 1x OSINT 12 2 http:scanssh:bruteforce — 2026-04-09 06:34 evidence →
103.231.14.54 credential_harvester 40% DROP 242 1 ssh:bruteforce spk.cloudie.hk 2026-03-26 14:32 evidence →
45.135.194.4 credential_harvester 40% DROP 14 2 ssh:bruteforce — 2026-04-12 04:36 evidence →
69.164.245.8 http:scan 39% 2x OSINT 2 2 http:scan — 2026-04-12 03:38 evidence →
103.236.140.19 credential_harvester 38% 91 1 ssh:bruteforce — 2026-03-28 10:51 evidence →
45.38.41.162 credential_harvester 36% 1x OSINT 15 1 ssh:bruteforce — 2026-04-12 07:50 evidence →
37.10.113.212 scanner 35% 3x OSINT 2 1 ssh:bruteforce — 2026-04-12 01:09 evidence →
45.79.115.59 scanner 34% 9 2 ssh:bruteforce — 2026-04-12 05:33 evidence →
49.51.132.100 http:scan 32% 4 2 http:scan — 2026-04-12 11:46 evidence →
46.151.182.183 mysql:bruteforce 32% DROP 2 2 mysql:bruteforce — 2026-04-12 12:34 evidence →
172.236.228.220 http:scan 30% 1x OSINT 7 2 http:scan — 2026-04-08 09:38 evidence →
43.153.123.4 http:scan 21% 2 2 http:scan — 2026-04-06 21:02 evidence →
45.205.1.8 scanner 19% DROP2x OSINT 1 1 http:scan — 2026-04-05 11:59 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds