IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
72 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
72 IPs
Below average
Total Events
260411
Top 1% by volume
Started / Ended
2026-03-05 12:19 — ongoing
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
193.46.255.86 credential_harvester 66% DROP1x OSINT 1999 2 ssh:bruteforce — 2026-04-12 19:03 evidence →
45.148.10.121 credential_harvester 65% DROP1x OSINT 8041 2 ssh:bruteforce — 2026-04-12 12:00 evidence →
1.214.197.163 credential_harvester 64% 800 2 ssh:bruteforce — 2026-04-12 17:18 evidence →
103.218.241.179 credential_harvester 64% 615 2 ssh:bruteforce — 2026-04-12 18:17 evidence →
104.244.74.84 credential_harvester 63% 724 2 ssh:bruteforce — 2026-04-12 11:59 evidence →
210.183.21.53 credential_harvester 63% 704 2 ssh:bruteforce — 2026-04-12 11:43 evidence →
118.193.33.3 credential_harvester 63% 802 2 ssh:bruteforce — 2026-04-12 02:45 evidence →
110.14.190.217 credential_harvester 63% 491 2 ssh:bruteforce — 2026-04-12 11:44 evidence →
213.209.159.158 credential_harvester 61% DROP1x OSINT 5438 2 ssh:bruteforce — 2026-04-09 20:02 evidence →
213.209.159.159 credential_harvester 61% DROP 15542 2 ssh:bruteforce — 2026-04-12 19:20 evidence →
123.60.136.40 credential_harvester 60% 113 2 ssh:bruteforce — 2026-04-12 12:34 evidence →
218.78.46.81 scanner 60% 62 2 ssh:bruteforce — 2026-04-12 17:33 evidence →
58.210.98.130 scanner 59% 57 2 ssh:bruteforce — 2026-04-12 16:38 evidence →
115.190.106.110 scanner 59% 69 2 ssh:bruteforce — 2026-04-12 12:15 evidence →
78.128.112.74 credential_harvester 59% 1x OSINT 4140 2 ssh:bruteforce ip-112-74.4vendeta.com 2026-04-12 18:43 evidence →
43.245.143.215 opportunistic_bruter 59% 46 2 ssh:bruteforce — 2026-04-11 22:40 evidence →
180.213.44.242 scanner 59% 59 2 ssh:bruteforce — 2026-04-12 10:24 evidence →
14.103.249.172 scanner 59% 60 2 ssh:bruteforce — 2026-04-12 09:43 evidence →
80.94.92.182 credential_harvester 59% DROP1x OSINT 5690 2 ssh:bruteforce — 2026-04-12 11:41 evidence →
103.236.140.19 credential_harvester 56% 94 2 ssh:bruteforce — 2026-04-10 11:17 evidence →
186.122.177.140 credential_harvester 56% 787 2 ssh:bruteforce host140.186-122-177.telmex.net.ar 2026-04-08 04:56 evidence →
89.190.156.34 credential_harvester 55% 23 2 ssh:bruteforce — 2026-04-12 12:53 evidence →
125.91.33.72 scanner 55% 256 2 ssh:bruteforce — 2026-04-08 16:51 evidence →
72.253.251.7 credential_harvester 54% 650 2 ssh:bruteforce — 2026-04-07 18:57 evidence →
102.210.149.105 credential_harvester 53% 513 2 ssh:bruteforce — 2026-04-07 12:13 evidence →
80.94.92.168 scanner 53% DROP1x OSINT 1138 2 ssh:bruteforce — 2026-04-12 18:22 evidence →
2.57.122.238 credential_harvester 53% DROP1x OSINT 6106 2 ssh:bruteforce — 2026-04-12 17:11 evidence →
92.118.39.76 credential_harvester 52% DROP1x OSINT 3904 2 ssh:bruteforce — 2026-04-12 11:29 evidence →
92.118.39.72 credential_harvester 52% DROP1x OSINT 3609 2 ssh:bruteforce — 2026-04-12 09:35 evidence →
92.118.39.56 credential_harvester 52% DROP1x OSINT 3545 2 ssh:bruteforce — 2026-04-12 08:22 evidence →
80.94.92.171 credential_harvester 52% DROP1x OSINT 2618 2 ssh:bruteforce — 2026-04-12 04:23 evidence →
80.94.92.184 credential_harvester 52% DROP1x OSINT 4861 2 ssh:bruteforce — 2026-04-12 00:10 evidence →
37.120.213.13 credential_harvester 51% VPN1x OSINT 75 2 ssh:bruteforce — 2026-04-12 07:50 evidence →
81.29.142.100 http:scan 50% 1x OSINT 81 2 http:scanmysql:bruteforcessh:bruteforce igutic.earnningipti.co.uk 2026-04-12 14:52 evidence →
172.236.228.218 scanner 49% 1x OSINT 24 2 http:scanssh:bruteforce — 2026-04-12 07:27 evidence →
119.96.157.188 scanner 48% 32 2 ssh:bruteforce — 2026-04-12 16:37 evidence →
2.57.121.112 credential_harvester 48% DROP 14579 2 ssh:bruteforce dns112.personaliseplus.com 2026-04-12 19:27 evidence →
45.205.1.8 scanner 48% DROP2x OSINT 9 2 http:scanssh:bruteforce — 2026-04-10 18:09 evidence →
2.57.122.191 opportunistic_bruter 47% DROP 60 2 ssh:bruteforce — 2026-04-12 13:03 evidence →
2.57.122.195 opportunistic_bruter 47% DROP 85 2 ssh:bruteforce — 2026-04-12 04:03 evidence →
2.57.122.192 opportunistic_bruter 46% DROP 50 2 ssh:bruteforce — 2026-04-12 13:02 evidence →
45.148.10.151 opportunistic_bruter 46% DROP 85 2 ssh:bruteforce — 2026-04-12 01:03 evidence →
2.57.121.69 opportunistic_bruter 46% DROP 50 2 ssh:bruteforce — 2026-04-12 10:02 evidence →
2.57.121.86 opportunistic_bruter 46% DROP 30 2 ssh:bruteforce — 2026-04-12 19:04 evidence →
45.148.10.152 opportunistic_bruter 46% DROP 65 2 ssh:bruteforce — 2026-04-12 01:03 evidence →
2.57.121.17 opportunistic_bruter 46% DROP 30 2 ssh:bruteforce — 2026-04-12 16:04 evidence →
2.57.121.25 credential_harvester 45% DROP 14282 2 ssh:bruteforce hosting25.tronicsat.com 2026-04-10 23:02 evidence →
37.10.113.212 scanner 45% 3x OSINT 4 2 ssh:bruteforce — 2026-04-12 01:09 evidence →
81.29.142.6 http:scan 44% 48 2 http:scanmysql:bruteforcessh:bruteforce chtlvv.rooseveraged.co.uk 2026-04-12 15:07 evidence →
80.253.31.232 credential_harvester 43% 60 2 ssh:bruteforce — 2026-04-12 11:44 evidence →
45.79.181.94 http:scan 42% 22 2 http:scanssh:bruteforce — 2026-04-12 06:21 evidence →
103.203.57.11 scanner 42% 1x OSINT 40 2 ssh:bruteforce scan-57-11.security.ipip.net 2026-04-12 16:53 evidence →
172.236.228.202 http:scan 42% 1x OSINT 13 2 http:scanssh:bruteforce — 2026-04-10 01:34 evidence →
85.11.167.2 mysql:bruteforce 42% DROP 157934 2 mysql:bruteforce — 2026-04-12 18:53 evidence →
165.227.139.253 scanner 42% 5 2 http:scanssh:bruteforce — 2026-04-12 11:43 evidence →
79.124.40.174 http:scan 42% 1x OSINT 89 2 http:scan ip-40-174.4vendeta.com 2026-04-12 06:34 evidence →
103.203.57.2 scanner 42% 1x OSINT 168 2 ssh:bruteforce scan-57-2.security.ipip.net 2026-04-10 23:23 evidence →
142.248.80.38 http:scan 41% 2x OSINT 6 2 http:scan — 2026-04-12 11:46 evidence →
110.166.87.119 scanner 41% 34 2 ssh:bruteforce — 2026-04-12 03:05 evidence →
45.135.194.4 credential_harvester 40% DROP 14 2 ssh:bruteforce — 2026-04-12 04:36 evidence →
5.101.64.6 scanner 39% 2x OSINT 84 2 ssh:bruteforce — 2026-04-08 11:40 evidence →
69.164.245.8 http:scan 39% 2x OSINT 2 2 http:scan — 2026-04-12 03:38 evidence →
45.38.41.162 credential_harvester 36% 1x OSINT 15 1 ssh:bruteforce — 2026-04-12 07:50 evidence →
45.79.115.59 scanner 34% 9 2 ssh:bruteforce — 2026-04-12 05:33 evidence →
172.234.217.192 http:scan 34% 16 2 http:scan — 2026-04-12 05:54 evidence →
172.236.127.133 http:scan 33% 12 2 http:scan — 2026-04-12 02:46 evidence →
172.236.228.115 http:scan 33% 1x OSINT 7 2 http:scan — 2026-04-09 15:35 evidence →
66.228.53.162 http:scan 32% 8 2 http:scan — 2026-04-12 00:11 evidence →
49.51.132.100 http:scan 32% 4 2 http:scan — 2026-04-12 11:46 evidence →
46.151.182.183 mysql:bruteforce 31% DROP 2 2 mysql:bruteforce — 2026-04-12 12:34 evidence →
172.236.228.220 http:scan 30% 1x OSINT 7 2 http:scan — 2026-04-08 09:38 evidence →
43.153.123.4 http:scan 21% 2 2 http:scan — 2026-04-06 21:02 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds