IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
80 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
80 IPs
Average
Total Events
139777
Top 10% by volume
Started / Ended
2026-03-01 01:52 — ongoing
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
213.209.159.158 credential_harvester 67% DROP1x OSINT 6372 2 ssh:bruteforce — 2026-04-17 06:53 evidence →
89.190.156.34 credential_harvester 66% 1x OSINT 210 2 ssh:bruteforce — 2026-04-17 01:26 evidence →
193.46.255.86 credential_harvester 65% DROP1x OSINT 2271 2 ssh:bruteforce — 2026-04-17 06:19 evidence →
45.148.10.121 credential_harvester 65% DROP1x OSINT 8515 2 ssh:bruteforce — 2026-04-17 02:00 evidence →
103.231.14.54 credential_harvester 64% DROP 1233 2 ssh:bruteforce spk.cloudie.hk 2026-04-17 08:46 evidence →
154.221.28.214 credential_harvester 64% 857 2 ssh:bruteforce — 2026-04-17 07:17 evidence →
67.71.54.129 credential_harvester 64% 835 2 ssh:bruteforce — 2026-04-17 05:00 evidence →
202.152.201.166 credential_harvester 64% 700 2 ssh:bruteforce — 2026-04-17 05:50 evidence →
222.98.122.37 credential_harvester 63% 658 2 ssh:bruteforce — 2026-04-17 04:23 evidence →
194.58.114.52 data_exfiltrator 62% 1x OSINT 29 2 ssh:bruteforce — 2026-04-16 14:08 evidence →
201.77.124.248 credential_harvester 62% 297 2 ssh:bruteforce — 2026-04-17 08:09 evidence →
196.196.253.20 credential_harvester 62% 286 2 ssh:bruteforce — 2026-04-17 08:05 evidence →
130.12.180.51 data_exfiltrator 62% DROP 2083 2 ssh:bruteforce — 2026-04-17 07:15 evidence →
212.115.54.84 credential_harvester 61% DROP 212 2 ssh:bruteforce — 2026-04-17 05:58 evidence →
101.52.130.122 credential_harvester 61% 202 2 ssh:bruteforce — 2026-04-17 05:33 evidence →
213.209.159.159 credential_harvester 61% DROP 16586 2 ssh:bruteforce — 2026-04-17 09:58 evidence →
219.150.93.157 scanner 60% 101 2 ssh:bruteforce — 2026-04-17 02:20 evidence →
112.216.108.62 credential_harvester 60% 71 2 ssh:bruteforce — 2026-04-17 05:31 evidence →
78.128.112.74 credential_harvester 59% 1x OSINT 4500 2 ssh:bruteforce ip-112-74.4vendeta.com 2026-04-17 09:13 evidence →
102.88.137.213 credential_harvester 59% 1167 2 ssh:bruteforce — 2026-04-14 07:39 evidence →
34.39.58.191 credential_harvester 58% 457 2 ssh:bruteforce — 2026-04-14 20:53 evidence →
115.85.80.12 credential_harvester 58% 617 2 ssh:bruteforce — 2026-04-14 13:41 evidence →
197.199.224.52 credential_harvester 56% 255 2 ssh:bruteforce — 2026-04-13 23:18 evidence →
186.80.18.158 credential_harvester 56% 435 2 ssh:bruteforce dynamic-ip-1868018158.cable.net.co 2026-04-13 10:13 evidence →
186.13.24.118 credential_harvester 55% 397 2 ssh:bruteforce host118.186-13-24.telmex.net.ar 2026-04-12 23:34 evidence →
109.206.241.199 malware_dropper 54% 92 2 ssh:bruteforce — 2026-04-14 03:53 evidence →
81.29.142.100 web_probe 54% 1x OSINT 89 2 http:scanmysql:bruteforcessh:bruteforce igutic.earnningipti.co.uk 2026-04-17 06:46 evidence →
65.49.1.80 scanner 54% 2x OSINT 8 2 http:scanssh:bruteforce — 2026-04-17 08:57 evidence →
113.137.40.250 scanner 52% 114 2 ssh:bruteforce — 2026-04-12 23:27 evidence →
172.236.228.111 web_probe 52% 1x OSINT 27 2 http:scanssh:bruteforce — 2026-04-17 04:54 evidence →
2.57.122.210 credential_harvester 52% DROP1x OSINT 5904 2 ssh:bruteforce — 2026-04-13 07:27 evidence →
117.149.196.213 scanner 52% 129 1 ssh:bruteforce — 2026-04-17 06:00 evidence →
43.133.148.170 credential_harvester 51% 535 2 ssh:bruteforce — 2026-04-10 23:52 evidence →
47.180.114.229 credential_harvester 51% 276 2 ssh:bruteforce 47-180-114-229.944e76fe48b133ae6f88b784db937d44.ip.frontiernet.net 2026-04-11 12:20 evidence →
45.227.254.170 opportunistic_bruter 51% 1x OSINT 45 2 ssh:bruteforce — 2026-04-17 07:02 evidence →
103.250.11.118 credential_harvester 50% 433 2 ssh:bruteforce — 2026-03-29 03:51 evidence →
2.57.121.25 credential_harvester 49% DROP 15182 2 ssh:bruteforce hosting25.tronicsat.com 2026-04-17 10:29 evidence →
2.57.121.112 credential_harvester 49% DROP 15560 2 ssh:bruteforce dns112.personaliseplus.com 2026-04-17 10:03 evidence →
92.118.39.76 credential_harvester 49% DROP1x OSINT 4096 2 ssh:bruteforce — 2026-04-17 08:22 evidence →
92.118.39.56 credential_harvester 49% DROP1x OSINT 3841 2 ssh:bruteforce — 2026-04-17 07:12 evidence →
92.118.39.72 credential_harvester 49% DROP1x OSINT 4029 2 ssh:bruteforce — 2026-04-17 05:47 evidence →
66.154.124.165 credential_harvester 49% 226 2 ssh:bruteforce — 2026-04-07 19:55 evidence →
80.94.92.168 scanner 49% DROP1x OSINT 1229 2 ssh:bruteforce — 2026-04-17 05:36 evidence →
36.212.217.15 scanner 48% 29 2 ssh:bruteforce — 2026-04-11 13:51 evidence →
120.48.130.213 scanner 47% 37 2 ssh:bruteforce — 2026-04-11 06:16 evidence →
186.96.145.241 credential_harvester 47% 31691 2 ssh:bruteforce — 2026-04-13 12:11 evidence →
172.236.228.218 scanner 47% 1x OSINT 38 2 http:scanssh:bruteforce — 2026-04-14 07:35 evidence →
66.228.53.46 web_probe 47% 21 2 http:scanssh:bruteforce — 2026-04-17 06:50 evidence →
172.236.119.165 web_probe 47% 23 2 http:scanssh:bruteforce — 2026-04-17 04:10 evidence →
79.124.40.174 web_probe 46% 1x OSINT 97 2 http:scan ip-40-174.4vendeta.com 2026-04-17 09:56 evidence →
172.245.16.13 credential_harvester 46% 50 2 ssh:bruteforce — 2026-04-17 02:56 evidence →
38.52.135.20 credential_harvester 46% 341 1 ssh:bruteforce — 2026-04-13 08:22 evidence →
118.196.73.14 scanner 45% 25 2 ssh:bruteforce — 2026-04-02 19:14 evidence →
94.102.49.155 scanner 45% DROP1x OSINT 94 2 ftp:bruteforcessh:bruteforce no-reverse-dns-configured.com 2026-04-13 01:34 evidence →
103.203.57.2 scanner 45% 1x OSINT 188 2 ssh:bruteforce scan-57-2.security.ipip.net 2026-04-17 03:57 evidence →
80.94.92.184 credential_harvester 44% DROP1x OSINT 5245 2 ssh:bruteforce — 2026-04-14 13:39 evidence →
5.101.64.6 scanner 44% 1x OSINT 92 2 ssh:bruteforce — 2026-04-17 10:24 evidence →
36.64.174.98 reconnaissance 44% 47 2 ssh:bruteforce — 2026-04-10 10:56 evidence →
45.148.10.152 opportunistic_bruter 43% DROP 90 2 ssh:bruteforce — 2026-04-14 16:02 evidence →
2.57.122.194 opportunistic_bruter 43% DROP 85 2 ssh:bruteforce — 2026-04-14 16:02 evidence →
45.148.10.157 opportunistic_bruter 42% DROP 102 2 ssh:bruteforce — 2026-04-14 04:03 evidence →
91.224.92.177 web_probe 42% DROP1x OSINT 7 2 http:scan — 2026-04-17 04:16 evidence →
8.152.209.0 scanner 42% 1x OSINT 27 2 ssh:bruteforce — 2026-04-17 08:04 evidence →
120.48.80.70 scanner 41% 29 1 ssh:bruteforce — 2026-04-12 23:08 evidence →
66.228.53.4 web_probe 40% 29 2 http:scanssh:bruteforce — 2026-04-13 12:58 evidence →
122.114.69.235 scanner 40% 19 2 ssh:bruteforce — 2026-04-13 10:57 evidence →
41.130.140.36 scanner 39% 1x OSINT 4 2 ssh:bruteforce — 2026-04-16 20:32 evidence →
103.183.13.42 scanner 39% 1x OSINT 4 2 ssh:bruteforce — 2026-04-16 20:04 evidence →
176.32.193.16 scanner 38% 2x OSINT 14 2 ssh:bruteforce — 2026-04-14 00:37 evidence →
207.154.230.149 credential_harvester 38% 23 1 ssh:bruteforce — 2026-04-11 09:07 evidence →
14.103.228.234 scanner 36% 23 1 ssh:bruteforce — 2026-03-28 09:00 evidence →
64.89.160.135 scanner 35% DROP 134 2 ssh:bruteforce — 2026-04-14 16:49 evidence →
165.101.251.150 credential_probe 34% 14 2 ssh:bruteforce — 2026-04-17 04:40 evidence →
213.177.179.80 scanner 31% DROP 24 2 ssh:bruteforce — 2026-04-14 10:38 evidence →
198.235.24.211 scanner 30% 1x OSINT 4 1 ssh:bruteforce — 2026-04-16 22:40 evidence →
64.89.163.93 mysql_probe 27% DROP1x OSINT 2 1 mysql:bruteforce — 2026-04-17 00:00 evidence →
119.148.49.82 scanner 25% 40 2 ssh:bruteforce — 2026-04-10 01:29 evidence →
43.166.245.120 web_probe 24% 2 2 http:scan — 2026-04-11 02:13 evidence →
43.157.43.147 web_probe 13% 1 1 http:scan — 2026-04-01 03:53 evidence →
46.151.182.164 mysql_probe 12% DROP 2 1 mysql:bruteforce — 2026-04-11 19:39 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds