← Back to feed

Multi-Agent Scan

SCAN Ended medium

Why this campaign was detected

12 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.

Primary ASN

—

Subnet

—

Country

—

Cloud Provider

—

Member Count

12 IPs

Below average

Total Events

420

Below average by volume

Started / Ended

2026-05-03 09:47 — 2026-08-19 21:30

Member Actors

IP Address	Behavior	Confidence	Flags	Events	Agents	Attack Types	Hostname	Last Seen
141.95.34.214	credential_harvester	36%		748	2	ssh:bruteforce	—	2026-07-06 12:58	evidence →
23.94.23.226	credential_harvester	36%		658	2	ssh:bruteforce	—	2026-07-10 02:58	evidence →
112.35.99.188	reconnaissance	35%		30	2	ssh:bruteforce	—	2026-05-12 10:38	evidence →
31.42.184.185	credential_harvester	35%		382	2	ssh:bruteforce	—	2026-07-13 21:22	evidence →
74.48.165.72	credential_harvester	34%		242	2	ssh:bruteforce	—	2026-05-20 04:47	evidence →
51.91.111.247	credential_harvester	34%		190	2	ssh:bruteforce	—	2026-05-29 10:34	evidence →
31.42.190.77	credential_harvester	33%	DROP	124	2	ssh:bruteforce	—	2026-06-08 05:33	evidence →
91.219.62.79	credential_harvester	33%		122	2	ssh:bruteforce	—	2026-05-20 12:01	evidence →
74.48.72.51	credential_harvester	32%		94	2	ssh:bruteforce	—	2026-05-17 19:39	evidence →
46.175.148.122	credential_harvester	32%		90	2	ssh:bruteforce	—	2026-05-16 09:19	evidence →
5.149.251.173	credential_harvester	31%		54	2	ssh:bruteforce	—	2026-05-13 09:39	evidence →
216.252.238.157	credential_probe	23%		40	2	ssh:bruteforce	—	2026-05-12 10:57	evidence →

VPN Known VPN or proxy provider

DROP ASN on Spamhaus DROP list

Nx OSINT Corroborated by N external threat feeds