IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
77 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
77 IPs
Below average
Total Events
274399
Top 5% by volume
Started / Ended
2026-02-28 14:22 — ongoing
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
213.209.159.158 credential_harvester 67% DROP1x OSINT 6372 2 ssh:bruteforce — 2026-04-17 06:53 evidence →
193.46.255.86 credential_harvester 65% DROP1x OSINT 2271 2 ssh:bruteforce — 2026-04-17 06:19 evidence →
45.148.10.121 credential_harvester 65% DROP1x OSINT 8515 2 ssh:bruteforce — 2026-04-17 02:00 evidence →
213.209.159.159 credential_harvester 61% DROP 16550 2 ssh:bruteforce — 2026-04-17 07:37 evidence →
20.203.42.204 credential_harvester 60% 2782 2 ssh:bruteforce — 2026-04-14 23:10 evidence →
78.128.112.74 credential_harvester 59% 1x OSINT 4490 2 ssh:bruteforce ip-112-74.4vendeta.com 2026-04-17 06:51 evidence →
185.249.74.198 credential_harvester 58% 705 2 ssh:bruteforce — 2026-04-14 07:25 evidence →
104.244.74.84 credential_harvester 58% 1065 2 ssh:bruteforce — 2026-04-13 21:00 evidence →
20.49.0.100 credential_harvester 57% 974 2 ssh:bruteforce — 2026-04-13 11:38 evidence →
118.193.33.3 credential_harvester 57% 806 2 ssh:bruteforce — 2026-04-13 13:28 evidence →
82.153.157.220 credential_harvester 57% 607 2 ssh:bruteforce — 2026-04-13 19:12 evidence →
45.61.52.18 credential_harvester 57% 406 2 ssh:bruteforce — 2026-04-14 03:40 evidence →
13.81.183.28 credential_harvester 57% 625 2 ssh:bruteforce — 2026-04-13 17:52 evidence →
162.19.243.145 credential_harvester 57% 859 2 ssh:bruteforce vps-19fa6452.vps.ovh.net 2026-04-13 09:57 evidence →
43.130.90.166 credential_harvester 57% 503 2 ssh:bruteforce — 2026-04-13 20:46 evidence →
152.32.252.65 credential_harvester 57% 705 2 ssh:bruteforce — 2026-04-13 10:13 evidence →
5.180.183.198 credential_harvester 57% 733 2 ssh:bruteforce — 2026-04-13 08:30 evidence →
8.245.17.190 credential_harvester 56% 715 2 ssh:bruteforce — 2026-04-13 05:25 evidence →
186.80.18.158 credential_harvester 56% 435 2 ssh:bruteforce dynamic-ip-1868018158.cable.net.co 2026-04-13 10:13 evidence →
172.83.83.216 credential_harvester 55% 364 2 ssh:bruteforce — 2026-04-13 08:11 evidence →
187.45.95.66 credential_harvester 55% 310 2 ssh:bruteforce — 2026-04-13 10:56 evidence →
103.147.159.91 credential_harvester 55% 416 2 ssh:bruteforce — 2026-04-13 01:46 evidence →
160.187.240.90 credential_harvester 55% 351 2 ssh:bruteforce — 2026-04-13 05:22 evidence →
186.13.24.118 credential_harvester 55% 397 2 ssh:bruteforce host118.186-13-24.telmex.net.ar 2026-04-12 23:34 evidence →
152.53.22.186 credential_harvester 54% 292 2 ssh:bruteforce — 2026-04-12 23:35 evidence →
2.57.121.112 credential_harvester 54% DROP1x OSINT 15524 2 ssh:bruteforce dns112.personaliseplus.com 2026-04-17 07:38 evidence →
36.138.202.60 scanner 54% 104 2 ssh:bruteforce — 2026-04-13 17:29 evidence →
14.103.112.110 scanner 54% 98 2 ssh:bruteforce — 2026-04-13 17:19 evidence →
201.186.40.161 opportunistic_bruter 53% 69 2 ssh:bruteforce — 2026-04-13 17:08 evidence →
123.60.136.40 credential_harvester 53% 117 2 ssh:bruteforce — 2026-04-13 03:04 evidence →
14.103.111.127 scanner 52% 56 2 ssh:bruteforce — 2026-04-13 09:24 evidence →
2.57.122.210 credential_harvester 52% DROP1x OSINT 5904 2 ssh:bruteforce — 2026-04-13 07:27 evidence →
172.236.119.165 web_probe 52% 1x OSINT 23 2 http:scanssh:bruteforce — 2026-04-17 04:10 evidence →
125.124.42.183 scanner 51% 32 2 ssh:bruteforce — 2026-04-13 12:29 evidence →
172.245.16.13 credential_harvester 51% 1x OSINT 50 2 ssh:bruteforce — 2026-04-17 02:56 evidence →
2.57.121.25 credential_harvester 49% DROP 15146 2 ssh:bruteforce hosting25.tronicsat.com 2026-04-17 07:59 evidence →
92.118.39.76 credential_harvester 49% DROP1x OSINT 4096 2 ssh:bruteforce — 2026-04-17 08:22 evidence →
92.118.39.56 credential_harvester 49% DROP1x OSINT 3841 2 ssh:bruteforce — 2026-04-17 07:12 evidence →
92.118.39.72 credential_harvester 49% DROP1x OSINT 4029 2 ssh:bruteforce — 2026-04-17 05:47 evidence →
80.94.92.168 scanner 49% DROP1x OSINT 1229 2 ssh:bruteforce — 2026-04-17 05:36 evidence →
172.236.228.218 scanner 47% 1x OSINT 38 2 http:scanssh:bruteforce — 2026-04-14 07:35 evidence →
94.102.49.155 scanner 45% DROP1x OSINT 94 2 ftp:bruteforcessh:bruteforce no-reverse-dns-configured.com 2026-04-13 01:34 evidence →
103.203.57.2 scanner 45% 1x OSINT 188 2 ssh:bruteforce scan-57-2.security.ipip.net 2026-04-17 03:57 evidence →
2.57.122.238 credential_harvester 45% DROP1x OSINT 6642 2 ssh:bruteforce — 2026-04-14 19:11 evidence →
81.29.142.6 web_probe 44% 58 2 http:scanmysql:bruteforcessh:bruteforce chtlvv.rooseveraged.co.uk 2026-04-14 19:37 evidence →
14.103.117.84 scanner 43% 75 2 ssh:bruteforce — 2026-04-13 15:15 evidence →
45.148.10.152 opportunistic_bruter 43% DROP 90 2 ssh:bruteforce — 2026-04-14 16:02 evidence →
45.148.10.151 opportunistic_bruter 42% DROP 95 2 ssh:bruteforce — 2026-04-14 07:02 evidence →
45.148.10.141 opportunistic_bruter 41% DROP 80 2 ssh:bruteforce — 2026-04-13 19:03 evidence →
79.124.40.174 web_probe 41% 1x OSINT 95 2 http:scan ip-40-174.4vendeta.com 2026-04-14 08:08 evidence →
66.228.53.4 web_probe 41% 29 2 http:scanssh:bruteforce — 2026-04-13 12:58 evidence →
2.57.121.17 opportunistic_bruter 40% DROP 45 2 ssh:bruteforce — 2026-04-13 22:02 evidence →
85.11.167.2 mysql_bruter 40% DROP 198187 2 mysql:bruteforce — 2026-04-14 23:33 evidence →
95.215.0.144 scanner 39% 1x OSINT 94 2 ssh:bruteforce scan.f6.security 2026-04-14 16:54 evidence →
176.32.193.16 scanner 38% 2x OSINT 14 2 ssh:bruteforce — 2026-04-14 00:37 evidence →
45.79.181.104 web_probe 38% 1x OSINT 13 2 http:scan — 2026-04-14 14:46 evidence →
172.236.228.115 web_probe 37% 1x OSINT 10 2 http:scan — 2026-04-14 11:56 evidence →
45.156.128.37 scanner 37% 6 2 http:scanssh:bruteforce — 2026-04-13 01:15 evidence →
172.236.127.133 web_probe 36% 1x OSINT 13 2 http:scan — 2026-04-13 17:13 evidence →
103.203.57.11 scanner 35% 1x OSINT 42 2 ssh:bruteforce scan-57-11.security.ipip.net 2026-04-13 05:34 evidence →
71.6.232.28 scanner 34% 1x OSINT 20 2 ssh:bruteforce — 2026-04-13 10:41 evidence →
45.79.115.59 scanner 34% 1x OSINT 11 2 ssh:bruteforce — 2026-04-13 19:34 evidence →
80.253.31.232 credential_harvester 33% 64 2 ssh:bruteforce — 2026-04-13 19:31 evidence →
66.228.62.150 scanner 33% 1x OSINT 12 2 ssh:bruteforce — 2026-04-13 08:36 evidence →
198.235.24.246 scanner 33% 1x OSINT 8 2 ssh:bruteforce — 2026-04-13 11:05 evidence →
172.234.217.192 web_probe 32% 19 2 http:scan — 2026-04-13 19:37 evidence →
213.177.179.80 scanner 31% DROP 24 2 ssh:bruteforce — 2026-04-14 10:38 evidence →
43.158.91.71 web_probe 31% 6 2 http:scan — 2026-04-13 18:53 evidence →
14.103.117.116 scanner 30% 15 2 ssh:bruteforce — 2026-04-13 15:17 evidence →
34.122.147.229 web_probe 30% 5 2 http:scan 229.147.122.34.bc.googleusercontent.com 2026-04-13 20:39 evidence →
81.30.212.94 scanner 30% 36 2 ssh:bruteforce 81.30.212.94.static.ufanet.ru 2026-04-13 10:16 evidence →
92.63.197.22 scanner 30% DROP 54 2 ssh:bruteforce — 2026-04-12 23:04 evidence →
135.148.120.46 web_probe 30% 5 2 http:scan — 2026-04-13 15:00 evidence →
202.58.242.243 web_probe 29% 2 2 http:scan — 2026-04-13 20:38 evidence →
194.195.210.47 scanner 29% 12 2 ssh:bruteforce — 2026-04-13 18:34 evidence →
185.26.121.89 scanner 27% 4 2 ssh:bruteforce — 2026-04-13 19:30 evidence →
206.189.75.42 scanner 27% 4 2 ssh:bruteforce — 2026-04-13 10:45 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds