IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
33 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
33 IPs
Below average
Total Events
7225
Below average by volume
Started / Ended
2026-05-05 04:10 — ongoing
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
80.94.92.186 credential_harvester 68% DROP2x OSINT 6298 3 ssh:bruteforce — 2026-05-11 20:12 evidence →
123.10.64.68 credential_harvester 51% 1x OSINT 51 2 ssh:bruteforce — 2026-05-11 09:26 evidence →
45.43.45.254 credential_harvester 49% 1x OSINT 80 2 ssh:bruteforce — 2026-05-11 14:49 evidence →
208.87.242.107 credential_harvester 49% 1x OSINT 68 2 ssh:bruteforce — 2026-05-11 17:19 evidence →
176.65.131.189 credential_harvester 49% 1x OSINT 58 2 ssh:bruteforce — 2026-05-11 20:30 evidence →
78.111.67.246 credential_harvester 49% 1x OSINT 46 2 ssh:bruteforce — 2026-05-11 19:57 evidence →
194.61.52.242 credential_harvester 48% DROP1x OSINT 40 2 ssh:bruteforce — 2026-05-11 17:29 evidence →
45.156.223.71 credential_harvester 48% 1x OSINT 54 2 ssh:bruteforce — 2026-05-11 10:37 evidence →
136.243.133.118 credential_harvester 48% 1x OSINT 30 2 ssh:bruteforce — 2026-05-11 20:36 evidence →
185.195.146.240 credential_harvester 48% 1x OSINT 36 2 ssh:bruteforce — 2026-05-11 16:35 evidence →
45.148.147.191 credential_harvester 47% 1x OSINT 20 2 ssh:bruteforce — 2026-05-11 15:29 evidence →
185.65.107.14 credential_harvester 45% 1x OSINT 32 2 ssh:bruteforce — 2026-05-11 20:15 evidence →
14.103.118.61 scanner 43% 1x OSINT 28 2 ssh:bruteforce — 2026-05-11 12:35 evidence →
191.241.76.128 credential_probe 41% 1x OSINT 46 2 ssh:bruteforce — 2026-05-11 20:32 evidence →
160.238.24.130 credential_probe 41% 1x OSINT 38 2 ssh:bruteforce — 2026-05-11 18:47 evidence →
162.244.81.120 credential_probe 41% 1x OSINT 40 2 ssh:bruteforce — 2026-05-11 17:00 evidence →
209.14.89.9 credential_probe 40% 1x OSINT 32 2 ssh:bruteforce — 2026-05-11 15:32 evidence →
74.48.105.66 credential_probe 40% 1x OSINT 28 2 ssh:bruteforce — 2026-05-11 18:04 evidence →
66.90.98.90 credential_probe 40% 1x OSINT 26 2 ssh:bruteforce — 2026-05-11 18:26 evidence →
89.37.116.208 credential_probe 40% 1x OSINT 28 2 ssh:bruteforce — 2026-05-11 15:51 evidence →
94.250.61.10 credential_probe 40% 1x OSINT 18 2 ssh:bruteforce — 2026-05-11 18:47 evidence →
34.140.129.51 mysql_probe 40% 2 2 ftp:bruteforcemysql:bruteforce — 2026-05-11 18:57 evidence →
198.20.104.203 credential_probe 40% 1x OSINT 20 2 ssh:bruteforce — 2026-05-11 15:49 evidence →
64.62.156.156 web_probe 40% 1x OSINT 2 2 http:scan — 2026-05-11 10:08 evidence →
74.48.174.146 credential_probe 40% 1x OSINT 20 2 ssh:bruteforce — 2026-05-11 13:45 evidence →
198.20.127.221 credential_probe 37% 60 2 ssh:bruteforce — 2026-05-11 18:50 evidence →
43.155.188.157 web_probe 37% 6 2 http:scan — 2026-05-11 15:29 evidence →
176.65.131.147 credential_harvester 36% 1x OSINT 6 1 ssh:bruteforce — 2026-05-11 17:08 evidence →
51.81.85.130 credential_probe 35% 26 2 ssh:bruteforce — 2026-05-11 14:05 evidence →
103.253.68.13 credential_probe 35% 20 2 ssh:bruteforce — 2026-05-11 12:59 evidence →
194.35.227.51 credential_probe 29% 1x OSINT 6 1 ssh:bruteforce — 2026-05-11 18:46 evidence →
69.175.92.21 credential_probe 29% 1x OSINT 6 1 ssh:bruteforce — 2026-05-11 18:25 evidence →
138.68.4.170 credential_probe 29% 1x OSINT 6 1 ssh:bruteforce — 2026-05-11 15:31 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds