IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
34 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
34 IPs
Below average
Total Events
9110
Below average by volume
Started / Ended
2026-04-07 08:58 — ongoing
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
112.151.178.49 credential_harvester 70% 1x OSINT 92 3 ssh:bruteforce — 2026-04-27 15:38 evidence →
82.64.38.234 credential_harvester 70% 1x OSINT 178 3 ssh:bruteforce — 2026-04-26 21:55 evidence →
46.6.125.137 credential_harvester 67% 1x OSINT 223 2 ssh:bruteforce — 2026-05-03 00:21 evidence →
147.50.227.79 credential_harvester 64% 1x OSINT 999 2 ssh:bruteforce — 2026-04-30 06:36 evidence →
161.248.189.72 credential_harvester 61% 1x OSINT 427 2 ssh:bruteforce — 2026-04-29 15:25 evidence →
143.64.168.136 scanner 61% 1x OSINT 95 2 ssh:bruteforce — 2026-04-30 14:12 evidence →
172.104.11.4 web_probe 60% 1x OSINT 28 3 http:scanssh:bruteforce — 2026-04-29 02:39 evidence →
14.29.240.154 scanner 60% 1x OSINT 59 2 ssh:bruteforce — 2026-04-30 16:55 evidence →
181.97.227.163 credential_harvester 58% 1x OSINT 240 1 ssh:bruteforce — 2026-05-02 23:18 evidence →
138.124.158.150 credential_harvester 58% 1x OSINT 601 2 ssh:bruteforce — 2026-04-27 06:53 evidence →
102.213.34.99 credential_harvester 57% 1x OSINT 261 2 ssh:bruteforce — 2026-04-27 20:56 evidence →
58.33.97.119 credential_harvester 57% 1x OSINT 412 2 ssh:bruteforce — 2026-04-27 08:32 evidence →
202.108.48.228 scanner 57% 1x OSINT 64 2 ssh:bruteforce — 2026-04-28 20:01 evidence →
38.137.11.14 credential_harvester 56% 1x OSINT 1474 2 ssh:bruteforce — 2026-04-25 09:38 evidence →
14.103.114.90 scanner 56% 1x OSINT 69 2 ssh:bruteforce — 2026-04-28 04:57 evidence →
45.119.212.99 credential_harvester 55% 1x OSINT 445 2 ssh:bruteforce — 2026-04-14 07:41 evidence →
36.110.172.218 credential_harvester 54% 1x OSINT 78 2 ssh:bruteforce — 2026-04-27 09:57 evidence →
14.103.202.69 scanner 54% 1x OSINT 60 2 ssh:bruteforce — 2026-04-27 09:40 evidence →
122.13.25.186 credential_harvester 53% 1x OSINT 118 2 ssh:bruteforce — 2026-04-25 05:03 evidence →
77.239.106.153 credential_harvester 52% DROP1x OSINT 222 1 ssh:bruteforce — 2026-04-30 04:11 evidence →
144.126.132.98 web_probe 44% 1x OSINT 2 2 http:scan — 2026-05-02 21:26 evidence →
147.185.132.69 scanner 43% 1x OSINT 10 2 http:scanssh:bruteforce — 2026-04-28 16:49 evidence →
64.89.163.97 mysql_bruter 43% DROP 6 3 mysql:bruteforce — 2026-04-28 14:37 evidence →
157.245.32.229 credential_probe 39% 1x OSINT 10 2 ssh:bruteforce — 2026-05-02 21:09 evidence →
192.109.200.238 reconnaissance 38% DROP1x OSINT 508 1 ssh:bruteforce — 2026-04-27 01:39 evidence →
3.139.242.79 web_probe 32% 3 2 http:scan — 2026-04-30 14:10 evidence →
45.79.207.252 scanner 29% 11 2 ssh:bruteforce — 2026-04-29 08:34 evidence →
14.103.107.50 scanner 28% 1x OSINT 19 2 ssh:bruteforce — 2026-04-21 06:27 evidence →
45.56.79.53 scanner 28% 1x OSINT 14 2 ssh:bruteforce — 2026-04-26 05:32 evidence →
34.76.59.29 ftp_probe 27% 3 2 ftp:bruteforcemysql:bruteforce — 2026-04-15 04:44 evidence →
89.212.129.161 scanner 27% 1x OSINT 2 1 ssh:bruteforce — 2026-05-02 02:11 evidence →
196.188.56.190 scanner 27% 1x OSINT 2 1 ssh:bruteforce — 2026-05-02 00:42 evidence →
45.79.207.111 scanner 26% 1x OSINT 5 2 ssh:bruteforce — 2026-04-15 18:40 evidence →
120.48.42.17 scanner 25% 1x OSINT 30 1 ssh:bruteforce — 2026-04-28 02:22 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds