IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
54 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
54 IPs
Below average
Total Events
47677
Average by volume
Started / Ended
2026-03-01 01:52 — ongoing
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
102.88.137.213 credential_harvester 64% 1x OSINT 1190 2 ssh:bruteforce — 2026-04-16 17:24 evidence →
47.180.114.229 credential_harvester 62% 518 2 ssh:bruteforce 47-180-114-229.944e76fe48b133ae6f88b784db937d44.ip.frontiernet.net 2026-04-19 00:21 evidence →
89.190.156.34 credential_harvester 60% 1x OSINT 298 2 ssh:bruteforce — 2026-04-15 21:57 evidence →
115.85.80.12 credential_harvester 59% 868 2 ssh:bruteforce — 2026-04-16 21:10 evidence →
34.39.58.191 credential_harvester 59% 875 2 ssh:bruteforce — 2026-04-16 17:59 evidence →
38.52.135.20 credential_harvester 59% 718 2 ssh:bruteforce — 2026-04-16 21:29 evidence →
186.13.24.118 credential_harvester 59% 702 2 ssh:bruteforce host118.186-13-24.telmex.net.ar 2026-04-16 21:32 evidence →
103.250.11.118 credential_harvester 59% 815 2 ssh:bruteforce — 2026-04-16 14:02 evidence →
43.133.148.170 credential_harvester 59% 558 2 ssh:bruteforce — 2026-04-16 21:37 evidence →
66.154.124.165 credential_harvester 58% 554 2 ssh:bruteforce — 2026-04-16 16:49 evidence →
197.199.224.52 credential_harvester 58% 560 2 ssh:bruteforce — 2026-04-16 14:22 evidence →
186.80.18.158 credential_harvester 58% 458 2 ssh:bruteforce dynamic-ip-1868018158.cable.net.co 2026-04-16 16:15 evidence →
202.152.201.166 credential_harvester 58% 425 2 ssh:bruteforce — 2026-04-16 15:18 evidence →
212.115.54.84 credential_harvester 57% DROP 494 2 ssh:bruteforce — 2026-04-16 08:52 evidence →
207.154.230.149 credential_harvester 57% 328 2 ssh:bruteforce — 2026-04-16 16:48 evidence →
120.48.130.213 scanner 56% 241 2 ssh:bruteforce — 2026-04-16 08:59 evidence →
113.137.40.250 scanner 56% 136 2 ssh:bruteforce — 2026-04-16 18:16 evidence →
117.149.196.213 scanner 56% 150 2 ssh:bruteforce — 2026-04-16 12:10 evidence →
109.206.241.199 malware_dropper 56% 115 2 ssh:bruteforce — 2026-04-16 17:24 evidence →
67.71.54.129 credential_harvester 55% 566 2 ssh:bruteforce — 2026-04-14 18:07 evidence →
103.236.140.19 credential_harvester 55% 98 2 ssh:bruteforce — 2026-04-16 07:46 evidence →
118.196.73.14 scanner 54% 62 2 ssh:bruteforce — 2026-04-16 13:45 evidence →
154.221.28.214 credential_harvester 54% 553 2 ssh:bruteforce — 2026-04-14 09:28 evidence →
36.212.217.15 scanner 54% 31 2 ssh:bruteforce — 2026-04-16 22:44 evidence →
94.102.49.155 scanner 53% DROP1x OSINT 101 2 ftp:bruteforcessh:bruteforce no-reverse-dns-configured.com 2026-04-19 12:29 evidence →
120.48.80.70 scanner 53% 34 2 ssh:bruteforce — 2026-04-16 15:20 evidence →
194.58.114.52 data_exfiltrator 53% 29 2 ssh:bruteforce — 2026-04-16 14:08 evidence →
14.103.228.234 scanner 53% 35 2 ssh:bruteforce — 2026-04-16 09:38 evidence →
45.227.254.170 opportunistic_bruter 51% 1x OSINT 50 2 ssh:bruteforce — 2026-04-19 07:02 evidence →
36.64.174.98 reconnaissance 51% 53 2 ssh:bruteforce — 2026-04-16 09:48 evidence →
222.98.122.37 credential_harvester 51% 635 2 ssh:bruteforce — 2026-04-12 12:22 evidence →
186.96.145.241 credential_harvester 49% 31711 2 ssh:bruteforce — 2026-04-16 16:56 evidence →
2.57.122.210 credential_harvester 49% DROP 6173 2 ssh:bruteforce — 2026-04-16 10:40 evidence →
101.52.130.122 credential_harvester 49% 199 2 ssh:bruteforce — 2026-04-11 16:04 evidence →
172.236.228.218 scanner 47% 1x OSINT 39 2 http:scanssh:bruteforce — 2026-04-16 09:02 evidence →
91.224.92.177 web_probe 47% DROP1x OSINT 19 2 http:scanssh:bruteforce — 2026-04-16 22:13 evidence →
66.228.53.46 web_probe 47% 23 2 http:scanssh:bruteforce — 2026-04-19 06:44 evidence →
219.150.93.157 scanner 46% 116 1 ssh:bruteforce — 2026-04-16 11:48 evidence →
172.236.228.111 web_probe 45% 1x OSINT 28 2 http:scanssh:bruteforce — 2026-04-15 15:47 evidence →
172.245.16.13 credential_harvester 44% 2x OSINT 40 2 ssh:bruteforce — 2026-04-13 20:40 evidence →
122.114.69.235 scanner 43% 25 2 ssh:bruteforce — 2026-04-16 22:42 evidence →
66.228.53.4 web_probe 43% 30 2 http:scanssh:bruteforce — 2026-04-16 22:41 evidence →
45.148.10.152 opportunistic_bruter 43% DROP 100 2 ssh:bruteforce — 2026-04-16 16:03 evidence →
172.236.119.165 web_probe 41% 22 2 http:scanssh:bruteforce — 2026-04-16 00:09 evidence →
112.216.108.62 credential_harvester 39% 48 1 ssh:bruteforce — 2026-04-13 06:46 evidence →
213.177.179.80 scanner 37% DROP1x OSINT 28 2 ssh:bruteforce — 2026-04-16 17:12 evidence →
198.235.24.211 scanner 35% 1x OSINT 8 2 ssh:bruteforce — 2026-04-16 22:40 evidence →
46.151.182.164 mysql_probe 32% DROP1x OSINT 3 2 mysql:bruteforce — 2026-04-16 12:44 evidence →
43.157.43.147 web_probe 31% 3 2 http:scan — 2026-04-16 23:23 evidence →
43.166.245.120 web_probe 30% 3 2 http:scan — 2026-04-16 10:43 evidence →
41.130.140.36 scanner 29% 4 2 ssh:bruteforce — 2026-04-16 20:32 evidence →
103.183.13.42 scanner 29% 4 2 ssh:bruteforce — 2026-04-16 20:04 evidence →
165.101.251.150 credential_probe 27% 11 2 ssh:bruteforce — 2026-04-15 20:10 evidence →
64.89.163.93 mysql_probe 24% DROP 2 2 mysql:bruteforce — 2026-04-15 09:33 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds