IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
72 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
72 IPs
Below average
Total Events
275880
Top 1% by volume
Started / Ended
2026-02-28 14:22 — ongoing
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
193.46.255.86 credential_harvester 66% DROP1x OSINT 2141 2 ssh:bruteforce — 2026-04-15 10:30 evidence →
45.148.10.121 credential_harvester 65% DROP1x OSINT 8283 2 ssh:bruteforce — 2026-04-15 09:24 evidence →
213.209.159.158 credential_harvester 62% DROP1x OSINT 5564 2 ssh:bruteforce — 2026-04-12 23:59 evidence →
213.209.159.159 credential_harvester 61% DROP 16028 2 ssh:bruteforce — 2026-04-15 09:50 evidence →
78.128.112.74 credential_harvester 59% 1x OSINT 4310 2 ssh:bruteforce ip-112-74.4vendeta.com 2026-04-15 10:03 evidence →
186.13.24.118 credential_harvester 58% 397 2 ssh:bruteforce host118.186-13-24.telmex.net.ar 2026-04-12 23:34 evidence →
118.193.33.3 credential_harvester 58% 802 2 ssh:bruteforce — 2026-04-12 02:45 evidence →
185.249.74.198 credential_harvester 58% 346 2 ssh:bruteforce — 2026-04-12 21:41 evidence →
152.53.22.186 credential_harvester 58% 292 2 ssh:bruteforce — 2026-04-12 23:35 evidence →
8.245.17.190 credential_harvester 58% 692 2 ssh:bruteforce — 2026-04-12 03:26 evidence →
20.203.42.204 credential_harvester 57% 2390 2 ssh:bruteforce — 2026-04-11 14:03 evidence →
162.19.243.145 credential_harvester 56% 518 2 ssh:bruteforce vps-19fa6452.vps.ovh.net 2026-04-11 09:42 evidence →
123.60.136.40 credential_harvester 55% 113 2 ssh:bruteforce — 2026-04-12 12:34 evidence →
2.57.122.210 credential_harvester 55% DROP1x OSINT 5497 2 ssh:bruteforce — 2026-04-12 23:59 evidence →
5.180.183.198 credential_harvester 55% 374 2 ssh:bruteforce — 2026-04-11 02:49 evidence →
45.61.52.18 credential_harvester 54% 397 2 ssh:bruteforce — 2026-04-10 20:39 evidence →
2.57.121.25 credential_harvester 54% DROP1x OSINT 14678 2 ssh:bruteforce hosting25.tronicsat.com 2026-04-15 09:50 evidence →
2.57.121.112 credential_harvester 54% DROP1x OSINT 15056 2 ssh:bruteforce dns112.personaliseplus.com 2026-04-15 09:44 evidence →
14.103.111.127 scanner 53% 52 2 ssh:bruteforce — 2026-04-12 06:18 evidence →
172.83.83.216 credential_harvester 53% 1x OSINT 341 1 ssh:bruteforce — 2026-04-12 09:54 evidence →
20.49.0.100 credential_harvester 53% 723 2 ssh:bruteforce — 2026-04-09 10:42 evidence →
152.32.252.65 credential_harvester 53% 682 2 ssh:bruteforce — 2026-04-09 12:02 evidence →
13.81.183.28 credential_harvester 51% 602 2 ssh:bruteforce — 2026-04-07 14:23 evidence →
14.103.112.110 scanner 50% 26 2 ssh:bruteforce — 2026-04-11 05:34 evidence →
36.138.202.60 scanner 50% 102 2 ssh:bruteforce — 2026-04-09 14:56 evidence →
82.153.157.220 credential_harvester 50% 333 2 ssh:bruteforce — 2026-03-20 22:40 evidence →
80.94.92.168 scanner 49% DROP1x OSINT 1166 2 ssh:bruteforce — 2026-04-15 10:28 evidence →
2.57.122.238 credential_harvester 49% DROP1x OSINT 6307 2 ssh:bruteforce — 2026-04-15 05:26 evidence →
92.118.39.72 credential_harvester 49% DROP1x OSINT 3777 2 ssh:bruteforce — 2026-04-15 03:41 evidence →
103.147.159.91 credential_harvester 48% 165 2 ssh:bruteforce — 2026-04-08 07:48 evidence →
186.80.18.158 credential_harvester 48% 144 2 ssh:bruteforce dynamic-ip-1868018158.cable.net.co 2026-04-08 12:08 evidence →
160.187.240.90 credential_harvester 47% 46 2 ssh:bruteforce — 2026-04-09 02:48 evidence →
45.148.10.141 opportunistic_bruter 47% DROP 80 2 ssh:bruteforce — 2026-04-15 07:02 evidence →
45.148.10.152 opportunistic_bruter 47% DROP 80 2 ssh:bruteforce — 2026-04-15 04:04 evidence →
172.236.228.218 scanner 46% 1x OSINT 25 2 http:scanssh:bruteforce — 2026-04-12 07:27 evidence →
79.124.40.174 web_probe 46% 1x OSINT 93 2 http:scan ip-40-174.4vendeta.com 2026-04-15 08:45 evidence →
92.118.39.76 credential_harvester 45% DROP1x OSINT 4032 2 ssh:bruteforce — 2026-04-12 23:15 evidence →
85.11.167.2 mysql_bruter 44% DROP 178539 2 mysql:bruteforce — 2026-04-15 10:20 evidence →
92.118.39.56 credential_harvester 44% DROP1x OSINT 3619 2 ssh:bruteforce — 2026-04-12 08:22 evidence →
81.29.142.6 web_probe 44% 56 2 http:scanmysql:bruteforcessh:bruteforce chtlvv.rooseveraged.co.uk 2026-04-12 15:07 evidence →
94.102.49.155 scanner 43% DROP1x OSINT 93 2 ftp:bruteforcessh:bruteforce no-reverse-dns-configured.com 2026-04-10 00:19 evidence →
172.236.119.165 web_probe 43% 1x OSINT 20 2 http:scanssh:bruteforce — 2026-04-10 12:28 evidence →
172.236.228.115 web_probe 42% 1x OSINT 9 2 http:scan — 2026-04-15 07:58 evidence →
187.45.95.66 credential_harvester 42% 287 1 ssh:bruteforce — 2026-04-09 06:30 evidence →
45.148.10.151 opportunistic_bruter 41% DROP 85 2 ssh:bruteforce — 2026-04-12 01:03 evidence →
2.57.121.17 opportunistic_bruter 41% DROP 30 2 ssh:bruteforce — 2026-04-12 16:04 evidence →
66.228.53.4 web_probe 41% 28 2 http:scanssh:bruteforce — 2026-04-11 15:20 evidence →
95.215.0.144 scanner 40% 2x OSINT 82 2 ssh:bruteforce scan.f6.security 2026-04-11 18:02 evidence →
103.203.57.2 scanner 40% 1x OSINT 176 2 ssh:bruteforce scan-57-2.security.ipip.net 2026-04-12 23:05 evidence →
80.94.92.171 credential_harvester 40% DROP 2640 2 ssh:bruteforce — 2026-04-12 20:32 evidence →
201.186.40.161 opportunistic_bruter 39% 46 1 ssh:bruteforce — 2026-04-09 08:51 evidence →
198.235.24.246 scanner 39% 1x OSINT 8 2 ssh:bruteforce — 2026-04-13 11:05 evidence →
125.124.42.183 scanner 38% 9 1 ssh:bruteforce — 2026-04-10 11:52 evidence →
206.189.75.42 scanner 38% 1x OSINT 4 2 ssh:bruteforce — 2026-04-13 10:45 evidence →
172.234.217.192 web_probe 38% 1x OSINT 17 2 http:scan — 2026-04-12 05:54 evidence →
103.203.57.11 scanner 37% 1x OSINT 40 2 ssh:bruteforce scan-57-11.security.ipip.net 2026-04-12 16:53 evidence →
176.32.193.16 scanner 37% 2x OSINT 10 2 ssh:bruteforce — 2026-04-11 22:40 evidence →
14.103.117.84 scanner 37% 72 2 ssh:bruteforce — 2026-04-07 17:14 evidence →
172.236.127.133 web_probe 37% 1x OSINT 12 2 http:scan — 2026-04-12 02:46 evidence →
66.228.62.150 scanner 34% 1x OSINT 10 2 ssh:bruteforce — 2026-04-12 06:32 evidence →
80.253.31.232 credential_harvester 34% 62 2 ssh:bruteforce — 2026-04-12 11:44 evidence →
45.79.181.104 web_probe 34% 1x OSINT 11 2 http:scan — 2026-04-10 12:55 evidence →
185.26.121.89 scanner 34% 4 2 ssh:bruteforce — 2026-04-13 19:30 evidence →
92.63.197.22 scanner 34% DROP 54 2 ssh:bruteforce — 2026-04-12 23:04 evidence →
81.30.212.94 scanner 33% 32 2 ssh:bruteforce 81.30.212.94.static.ufanet.ru 2026-04-12 21:28 evidence →
194.195.210.47 scanner 30% 1x OSINT 10 2 ssh:bruteforce — 2026-04-10 04:33 evidence →
213.177.179.80 scanner 28% DROP1x OSINT 16 2 ssh:bruteforce — 2026-04-08 00:05 evidence →
71.6.232.28 scanner 28% 1x OSINT 12 2 ssh:bruteforce — 2026-03-30 09:17 evidence →
45.156.128.37 scanner 27% 4 1 http:scanssh:bruteforce — 2026-04-11 00:21 evidence →
14.103.117.116 scanner 27% 13 2 ssh:bruteforce — 2026-04-09 18:38 evidence →
43.158.91.71 web_probe 25% 5 2 http:scan — 2026-04-09 03:15 evidence →
135.148.120.46 web_probe 24% 4 2 http:scan — 2026-04-07 00:30 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds