IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
35 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
35 IPs
Below average
Total Events
41502
Average by volume
Started / Ended
2026-02-28 00:48 — ongoing
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
194.58.114.52 data_exfiltrator 62% 1x OSINT 29 2 ssh:bruteforce — 2026-04-16 14:08 evidence →
102.88.137.213 credential_harvester 59% 1167 2 ssh:bruteforce — 2026-04-14 07:39 evidence →
34.39.58.191 credential_harvester 59% 457 2 ssh:bruteforce — 2026-04-14 20:53 evidence →
115.85.80.12 credential_harvester 59% 617 2 ssh:bruteforce — 2026-04-14 13:41 evidence →
197.199.224.52 credential_harvester 56% 255 2 ssh:bruteforce — 2026-04-13 23:18 evidence →
186.80.18.158 credential_harvester 56% 435 2 ssh:bruteforce dynamic-ip-1868018158.cable.net.co 2026-04-13 10:13 evidence →
186.13.24.118 credential_harvester 55% 397 2 ssh:bruteforce host118.186-13-24.telmex.net.ar 2026-04-12 23:34 evidence →
109.206.241.199 malware_dropper 55% 92 2 ssh:bruteforce — 2026-04-14 03:53 evidence →
113.137.40.250 scanner 53% 114 2 ssh:bruteforce — 2026-04-12 23:27 evidence →
43.133.148.170 credential_harvester 52% 535 2 ssh:bruteforce — 2026-04-10 23:52 evidence →
47.180.114.229 credential_harvester 52% 276 2 ssh:bruteforce 47-180-114-229.944e76fe48b133ae6f88b784db937d44.ip.frontiernet.net 2026-04-11 12:20 evidence →
103.250.11.118 credential_harvester 50% 433 2 ssh:bruteforce — 2026-03-29 03:51 evidence →
66.154.124.165 credential_harvester 49% 226 2 ssh:bruteforce — 2026-04-07 19:55 evidence →
36.212.217.15 scanner 48% 29 2 ssh:bruteforce — 2026-04-11 13:51 evidence →
186.96.145.241 credential_harvester 48% 31691 2 ssh:bruteforce — 2026-04-13 12:11 evidence →
38.52.135.20 credential_harvester 47% 341 1 ssh:bruteforce — 2026-04-13 08:22 evidence →
36.64.174.98 reconnaissance 44% 47 2 ssh:bruteforce — 2026-04-10 10:56 evidence →
120.48.80.70 scanner 42% 29 1 ssh:bruteforce — 2026-04-12 23:08 evidence →
66.228.53.4 web_probe 41% 29 2 http:scanssh:bruteforce — 2026-04-13 12:58 evidence →
122.114.69.235 scanner 41% 19 2 ssh:bruteforce — 2026-04-13 10:57 evidence →
94.102.49.155 scanner 41% DROP 94 2 ftp:bruteforcessh:bruteforce no-reverse-dns-configured.com 2026-04-13 01:34 evidence →
41.130.140.36 scanner 39% 1x OSINT 4 2 ssh:bruteforce — 2026-04-16 20:32 evidence →
103.183.13.42 scanner 39% 1x OSINT 4 2 ssh:bruteforce — 2026-04-16 20:04 evidence →
207.154.230.149 credential_harvester 38% 23 1 ssh:bruteforce — 2026-04-11 09:07 evidence →
92.118.39.76 credential_harvester 37% DROP 4032 2 ssh:bruteforce — 2026-04-12 23:15 evidence →
14.103.228.234 scanner 36% 23 1 ssh:bruteforce — 2026-03-28 09:00 evidence →
176.32.193.16 scanner 35% 1x OSINT 14 2 ssh:bruteforce — 2026-04-14 00:37 evidence →
213.177.179.80 scanner 32% DROP 24 2 ssh:bruteforce — 2026-04-14 10:38 evidence →
198.235.24.211 scanner 30% 4 1 ssh:bruteforce — 2026-04-16 22:40 evidence →
119.148.49.82 scanner 25% 40 2 ssh:bruteforce — 2026-04-10 01:29 evidence →
43.166.245.120 web_probe 25% 2 2 http:scan — 2026-04-11 02:13 evidence →
69.164.217.74 scanner 24% 15 2 ssh:bruteforce — 2026-04-10 19:33 evidence →
64.89.163.93 mysql_probe 23% DROP 2 1 mysql:bruteforce — 2026-04-17 00:00 evidence →
46.151.182.164 mysql_probe 13% DROP 2 1 mysql:bruteforce — 2026-04-11 19:39 evidence →
43.157.43.147 web_probe 13% 1 1 http:scan — 2026-04-01 03:53 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds