IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
36 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
36 IPs
Below average
Total Events
5101
Below average by volume
Started / Ended
2026-03-02 10:35 — ongoing
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
103.250.11.118 credential_harvester 64% 792 2 ssh:bruteforce — 2026-04-16 14:02 evidence →
103.143.238.100 credential_harvester 63% 871 2 ssh:bruteforce — 2026-04-16 08:18 evidence →
66.154.124.165 credential_harvester 63% 531 2 ssh:bruteforce — 2026-04-16 16:49 evidence →
197.199.224.52 credential_harvester 63% 560 2 ssh:bruteforce — 2026-04-16 14:22 evidence →
194.58.114.52 data_exfiltrator 63% 1x OSINT 29 2 ssh:bruteforce — 2026-04-16 14:08 evidence →
112.217.199.222 credential_harvester 63% 658 2 ssh:bruteforce — 2026-04-16 04:38 evidence →
207.154.230.149 credential_harvester 62% 328 2 ssh:bruteforce — 2026-04-16 16:48 evidence →
165.154.23.29 credential_harvester 61% 356 2 ssh:bruteforce — 2026-04-16 02:45 evidence →
120.48.130.213 scanner 61% 241 2 ssh:bruteforce — 2026-04-16 08:59 evidence →
103.236.140.19 credential_harvester 60% 98 2 ssh:bruteforce — 2026-04-16 07:46 evidence →
120.48.80.70 scanner 58% 34 2 ssh:bruteforce — 2026-04-16 15:20 evidence →
118.196.73.14 scanner 58% 32 2 ssh:bruteforce — 2026-04-16 13:45 evidence →
36.64.174.98 reconnaissance 56% 53 2 ssh:bruteforce — 2026-04-16 09:48 evidence →
89.190.156.34 credential_harvester 51% 168 2 ssh:bruteforce — 2026-04-12 12:53 evidence →
14.103.228.234 scanner 48% 25 1 ssh:bruteforce — 2026-04-16 09:38 evidence →
2.57.122.194 opportunistic_bruter 48% DROP 90 2 ssh:bruteforce — 2026-04-16 16:02 evidence →
3.151.241.153 scanner 46% 25 2 http:scanssh:bruteforce — 2026-04-16 03:41 evidence →
95.85.245.170 credential_harvester 45% 47 2 ssh:bruteforce — 2026-04-16 03:33 evidence →
213.177.179.80 scanner 42% DROP1x OSINT 28 2 ssh:bruteforce — 2026-04-16 17:12 evidence →
103.180.237.169 web_probe 39% 1x OSINT 2 2 http:scan — 2026-04-16 04:17 evidence →
180.93.75.229 scanner 39% 1x OSINT 4 2 ssh:bruteforce — 2026-04-15 20:03 evidence →
223.83.114.88 scanner 38% 1x OSINT 21 2 ssh:bruteforce — 2026-04-14 23:13 evidence →
43.157.175.122 web_probe 36% 5 2 http:scan — 2026-04-16 03:30 evidence →
49.51.132.100 web_probe 35% 5 2 http:scan — 2026-04-16 01:32 evidence →
43.166.245.120 web_probe 35% 3 2 http:scan — 2026-04-16 10:43 evidence →
104.197.69.115 web_probe 35% 3 2 http:scan — 2026-04-16 06:09 evidence →
45.79.8.221 scanner 35% 13 2 ssh:bruteforce — 2026-04-16 05:32 evidence →
205.169.39.16 web_probe 35% 2 2 http:scan — 2026-04-16 06:58 evidence →
2.26.81.183 credential_probe 34% 20 2 ssh:bruteforce — 2026-04-16 09:10 evidence →
45.79.211.97 scanner 34% 11 2 ssh:bruteforce — 2026-04-16 04:32 evidence →
43.224.126.107 scanner 33% 2x OSINT 20 2 ssh:bruteforce — 2026-04-10 04:49 evidence →
46.151.182.164 mysql_probe 32% DROP 3 2 mysql:bruteforce — 2026-04-16 12:44 evidence →
43.157.191.20 web_probe 29% 5 2 http:scan — 2026-04-12 16:41 evidence →
66.228.53.162 web_probe 29% 9 2 http:scan — 2026-04-12 00:11 evidence →
64.89.163.167 mysql_bruter 23% DROP1x OSINT 4 1 mysql:bruteforce — 2026-04-12 08:01 evidence →
104.248.232.41 credential_probe 16% 5 1 ssh:bruteforce — 2026-04-12 10:10 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds