← Back to feed

Multi-Agent Scan

SCAN Active medium

Why this campaign was detected

13 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.

Primary ASN

—

Subnet

—

Country

—

Cloud Provider

—

Member Count

13 IPs

Below average

Total Events

1974

Below average by volume

Started / Ended

2026-03-06 21:54 — ongoing

Member Actors

IP Address	Behavior	Confidence	Flags	Events	Agents	Attack Types	Hostname	Last Seen
104.244.74.84	credential_harvester	64%		742	2	ssh:bruteforce	—	2026-04-13 21:00	evidence →
82.153.157.220	credential_harvester	63%		607	2	ssh:bruteforce	—	2026-04-13 19:12	evidence →
13.81.183.28	credential_harvester	63%		625	2	ssh:bruteforce	—	2026-04-13 17:52	evidence →
201.186.40.161	opportunistic_bruter	59%		69	2	ssh:bruteforce	—	2026-04-13 17:08	evidence →
125.124.42.183	scanner	58%		32	2	ssh:bruteforce	—	2026-04-13 12:29	evidence →
14.103.117.84	scanner	49%		75	2	ssh:bruteforce	—	2026-04-13 15:15	evidence →
95.215.0.144	scanner	47%	2x OSINT	88	2	ssh:bruteforce	scan.f6.security	2026-04-13 22:18	evidence →
176.32.193.16	scanner	44%	2x OSINT	12	2	ssh:bruteforce	—	2026-04-13 16:59	evidence →
66.228.53.4	http:scan	43%		29	2	http:scanssh:bruteforce	—	2026-04-13 12:58	evidence →
213.177.179.80	scanner	41%	DROP1x OSINT	20	2	ssh:bruteforce	—	2026-04-13 15:12	evidence →
135.148.120.46	http:scan	37%	1x OSINT	5	2	http:scan	—	2026-04-13 15:00	evidence →
185.26.121.89	scanner	34%		4	2	ssh:bruteforce	—	2026-04-13 19:30	evidence →
43.158.91.71	http:scan	33%		6	2	http:scan	—	2026-04-13 18:53	evidence →

VPN Known VPN or proxy provider

DROP ASN on Spamhaus DROP list

Nx OSINT Corroborated by N external threat feeds