IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
34 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
34 IPs
Below average
Total Events
6048
Below average by volume
Started / Ended
2026-03-09 00:25 — ongoing
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
203.150.107.244 credential_harvester 64% 1105 2 ssh:bruteforce 244.107.150.203.sta.inet.co.th 2026-04-18 13:16 evidence →
185.239.87.249 credential_harvester 64% DROP 736 2 ssh:bruteforce — 2026-04-18 11:11 evidence →
212.154.234.9 credential_harvester 63% 957 2 ssh:bruteforce — 2026-04-18 00:24 evidence →
171.25.158.74 credential_harvester 63% 660 2 ssh:bruteforce — 2026-04-18 07:52 evidence →
170.79.37.82 credential_harvester 62% 354 2 ssh:bruteforce — 2026-04-18 11:50 evidence →
27.79.45.122 credential_harvester 62% 1x OSINT 191 2 ssh:bruteforce — 2026-04-18 05:23 evidence →
114.220.238.224 scanner 60% 104 2 ssh:bruteforce — 2026-04-18 08:57 evidence →
110.166.87.119 scanner 59% 61 2 ssh:bruteforce — 2026-04-18 07:57 evidence →
45.148.10.183 credential_harvester 57% DROP1x OSINT 344 2 ssh:bruteforce — 2026-04-18 17:13 evidence →
193.32.162.82 credential_harvester 55% DROP1x OSINT 134 2 ssh:bruteforce — 2026-04-18 08:36 evidence →
192.99.169.99 credential_harvester 53% 391 2 ssh:bruteforce vps-572274cb.vps.ovh.ca 2026-04-13 13:23 evidence →
8.222.128.242 scanner 53% 2x OSINT 14 2 mysql:bruteforcessh:bruteforce — 2026-04-18 10:42 evidence →
103.154.62.14 credential_harvester 52% 365 1 ssh:bruteforce — 2026-04-18 00:28 evidence →
74.82.47.4 scanner 49% 1x OSINT 7 2 http:scanssh:bruteforce — 2026-04-18 01:30 evidence →
103.52.114.122 credential_harvester 49% 179 2 ssh:bruteforce — 2026-03-26 12:02 evidence →
221.229.218.50 scanner 48% 119 2 ssh:bruteforce — 2026-04-10 05:24 evidence →
111.26.6.111 scanner 47% 26 2 ssh:bruteforce — 2026-04-18 04:17 evidence →
138.124.30.225 opportunistic_bruter 45% 30 2 ssh:bruteforce — 2026-04-18 02:02 evidence →
147.185.132.222 scanner 42% 2x OSINT 6 2 ssh:bruteforce — 2026-04-18 05:19 evidence →
213.177.179.80 scanner 42% DROP1x OSINT 32 2 ssh:bruteforce — 2026-04-18 15:18 evidence →
2.57.122.188 opportunistic_bruter 42% DROP 70 2 ssh:bruteforce — 2026-04-15 13:03 evidence →
45.39.12.34 credential_probe 41% 1x OSINT 36 2 ssh:bruteforce — 2026-04-18 13:07 evidence →
106.13.69.159 scanner 39% 108 1 ssh:bruteforce — 2026-04-11 05:39 evidence →
165.232.74.249 scanner 38% 3x OSINT 4 2 ssh:bruteforce — 2026-04-17 19:01 evidence →
47.104.198.108 scanner 38% 70 2 ssh:bruteforce — 2026-04-18 12:57 evidence →
31.56.209.39 reconnaissance 38% DROP 12 1 ssh:bruteforce — 2026-04-18 13:20 evidence →
46.151.182.162 mysql_probe 36% DROP1x OSINT 4 2 mysql:bruteforce — 2026-04-18 01:55 evidence →
43.167.245.18 web_probe 36% 4 2 http:scan — 2026-04-18 14:35 evidence →
45.79.207.110 scanner 35% 17 2 ssh:bruteforce — 2026-04-18 06:33 evidence →
43.153.192.98 web_probe 35% 4 2 http:scan — 2026-04-18 00:45 evidence →
45.148.10.67 web_probe 35% DROP 2 2 http:scan — 2026-04-18 10:02 evidence →
46.151.182.161 mysql_probe 32% DROP 4 2 mysql:bruteforce — 2026-04-18 04:07 evidence →
34.22.172.118 ftp_probe 31% 2 2 ftp:bruteforce — 2026-04-18 01:25 evidence →
205.210.31.128 scanner 19% 1x OSINT 4 1 ssh:bruteforce — 2026-04-12 16:35 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds