IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
38 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
38 IPs
Below average
Total Events
4981
Below average by volume
Started / Ended
2026-03-19 04:50 — ongoing
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
103.31.39.143 credential_harvester 59% 789 2 ssh:bruteforce — 2026-04-14 14:41 evidence →
170.238.160.191 credential_harvester 59% 642 2 ssh:bruteforce — 2026-04-14 18:07 evidence →
210.79.191.170 credential_harvester 59% 625 2 ssh:bruteforce — 2026-04-14 18:11 evidence →
137.184.228.138 credential_harvester 59% 771 2 ssh:bruteforce — 2026-04-14 13:10 evidence →
118.26.36.248 credential_harvester 59% 751 2 ssh:bruteforce — 2026-04-14 11:48 evidence →
51.163.39.213 credential_harvester 59% 494 2 ssh:bruteforce — 2026-04-14 20:52 evidence →
41.59.229.33 credential_harvester 58% 597 2 ssh:bruteforce — 2026-04-14 13:02 evidence →
185.249.74.198 credential_harvester 58% 705 2 ssh:bruteforce — 2026-04-14 07:25 evidence →
135.235.138.43 credential_harvester 57% 407 2 ssh:bruteforce — 2026-04-14 10:03 evidence →
115.190.74.101 scanner 57% 223 2 ssh:bruteforce — 2026-04-14 14:25 evidence →
14.103.127.242 scanner 56% 138 2 ssh:bruteforce — 2026-04-14 13:01 evidence →
180.184.38.93 scanner 56% 120 2 ssh:bruteforce — 2026-04-14 12:32 evidence →
196.189.155.89 credential_harvester 50% 519 2 ssh:bruteforce — 2026-04-07 06:18 evidence →
172.236.228.218 scanner 47% 1x OSINT 38 2 http:scanssh:bruteforce — 2026-04-14 07:35 evidence →
172.236.228.202 web_probe 47% 1x OSINT 15 2 http:scanssh:bruteforce — 2026-04-14 23:47 evidence →
14.103.71.220 scanner 45% 54 2 ssh:bruteforce — 2026-04-14 17:38 evidence →
2.57.122.194 opportunistic_bruter 43% DROP 85 2 ssh:bruteforce — 2026-04-14 16:02 evidence →
27.40.98.231 scanner 42% 14 2 ssh:bruteforce — 2026-04-14 17:35 evidence →
91.224.92.177 web_probe 42% DROP1x OSINT 7 2 http:scan — 2026-04-17 04:16 evidence →
45.148.10.141 opportunistic_bruter 41% DROP 80 2 ssh:bruteforce — 2026-04-13 19:03 evidence →
45.79.181.104 web_probe 38% 1x OSINT 13 2 http:scan — 2026-04-14 14:46 evidence →
71.6.199.65 scanner 37% 1x OSINT 24 2 ssh:bruteforce — 2026-04-14 23:36 evidence →
172.236.228.193 web_probe 37% 1x OSINT 10 2 http:scan — 2026-04-14 09:13 evidence →
45.33.109.8 scanner 36% 1x OSINT 14 2 ssh:bruteforce — 2026-04-14 19:33 evidence →
45.156.128.41 web_probe 35% 1x OSINT 4 2 http:scan — 2026-04-14 04:13 evidence →
87.251.64.150 mysql_bruter 35% 1x OSINT 4 2 ssh:bruteforce — 2026-04-14 16:40 evidence →
45.79.115.134 scanner 35% 1x OSINT 8 2 ssh:bruteforce — 2026-04-14 14:41 evidence →
45.156.22.81 credential_harvester 35% 50 2 ssh:bruteforce — 2026-04-14 18:19 evidence →
165.101.251.150 credential_probe 34% 14 2 ssh:bruteforce — 2026-04-17 04:40 evidence →
45.79.115.59 scanner 34% 1x OSINT 11 2 ssh:bruteforce — 2026-04-13 19:34 evidence →
64.89.163.153 mysql_probe 32% DROP1x OSINT 3 2 mysql:bruteforce — 2026-04-14 13:38 evidence →
64.89.163.80 mysql_probe 32% DROP1x OSINT 4 2 mysql:bruteforce — 2026-04-14 07:45 evidence →
124.156.179.141 web_probe 32% 8 2 http:scan — 2026-04-14 07:31 evidence →
58.250.244.36 scanner 31% 12 2 ssh:bruteforce — 2026-04-14 23:48 evidence →
160.22.7.162 web_probe 30% 2 2 http:scan — 2026-04-14 09:44 evidence →
134.199.160.74 scanner 29% 4 2 ssh:bruteforce — 2026-04-14 17:26 evidence →
34.79.177.120 mysql_probe 21% 2 1 ftp:bruteforcemysql:bruteforce — 2026-04-12 00:16 evidence →
206.189.196.74 scanner 19% 4 1 ssh:bruteforce — 2026-04-14 07:06 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds