IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
35 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
35 IPs
Below average
Total Events
3404
Below average by volume
Started / Ended
2026-05-03 01:54 — ongoing
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
185.113.139.51 credential_harvester 69% 1x OSINT 944 2 ssh:bruteforce undefined.hostname.localhost 2026-05-14 09:49 evidence →
43.133.148.170 credential_harvester 69% 1x OSINT 927 2 ssh:bruteforce — 2026-05-14 09:57 evidence →
201.69.154.239 credential_harvester 67% 1x OSINT 287 2 ssh:bruteforce — 2026-05-14 12:12 evidence →
14.103.111.127 scanner 66% 1x OSINT 156 2 ssh:bruteforce — 2026-05-14 09:53 evidence →
115.151.72.155 credential_harvester 66% 1x OSINT 133 2 ssh:bruteforce — 2026-05-14 11:37 evidence →
172.105.128.12 web_probe 63% 61 3 http:scanssh:bruteforce — 2026-05-14 06:00 evidence →
80.66.83.43 scanner 58% 1x OSINT 60 3 ssh:bruteforce — 2026-05-14 11:45 evidence →
64.89.163.141 mysql_bruter 56% DROP1x OSINT 8 3 mysql:bruteforce — 2026-05-14 06:15 evidence →
43.166.128.86 web_probe 51% 4 3 http:scan — 2026-05-14 05:47 evidence →
195.201.140.251 credential_harvester 50% 1x OSINT 90 2 ssh:bruteforce — 2026-05-14 11:05 evidence →
157.90.131.179 credential_harvester 50% 1x OSINT 104 2 ssh:bruteforce — 2026-05-14 07:27 evidence →
69.25.10.167 credential_harvester 50% 1x OSINT 70 2 ssh:bruteforce — 2026-05-14 11:34 evidence →
102.129.186.123 credential_harvester 49% 1x OSINT 78 2 ssh:bruteforce — 2026-05-14 07:09 evidence →
186.226.56.200 credential_harvester 49% 1x OSINT 56 2 ssh:bruteforce — 2026-05-14 09:42 evidence →
66.90.98.90 credential_harvester 49% 1x OSINT 46 2 ssh:bruteforce — 2026-05-14 11:37 evidence →
36.50.40.252 credential_harvester 48% 1x OSINT 42 2 ssh:bruteforce — 2026-05-14 08:49 evidence →
5.161.147.167 credential_harvester 48% 1x OSINT 42 2 ssh:bruteforce — 2026-05-14 05:49 evidence →
23.131.184.100 credential_harvester 48% 1x OSINT 28 2 ssh:bruteforce — 2026-05-14 11:05 evidence →
185.202.223.106 credential_harvester 48% 1x OSINT 28 2 ssh:bruteforce — 2026-05-14 11:06 evidence →
185.89.249.3 credential_harvester 48% 1x OSINT 28 2 ssh:bruteforce — 2026-05-14 09:01 evidence →
184.154.78.38 credential_harvester 48% 1x OSINT 28 2 ssh:bruteforce — 2026-05-14 07:57 evidence →
65.109.228.161 credential_harvester 48% 1x OSINT 28 2 ssh:bruteforce — 2026-05-14 05:20 evidence →
198.98.52.145 credential_harvester 48% 1x OSINT 28 2 ssh:bruteforce — 2026-05-14 05:11 evidence →
151.236.16.192 credential_harvester 47% VPN1x OSINT 20 2 ssh:bruteforce — 2026-05-14 09:27 evidence →
142.171.90.82 credential_harvester 45% 76 2 ssh:bruteforce — 2026-05-14 07:39 evidence →
103.79.244.210 scanner 44% 54 2 ssh:bruteforce — 2026-05-14 08:50 evidence →
149.19.166.51 credential_harvester 44% 42 2 ssh:bruteforce — 2026-05-14 12:51 evidence →
101.53.148.190 credential_harvester 44% 56 2 ssh:bruteforce — 2026-05-14 04:33 evidence →
111.21.105.250 scanner 43% 2x OSINT 9 2 ssh:bruteforce — 2026-05-14 11:12 evidence →
209.141.57.35 credential_harvester 43% 34 2 ssh:bruteforce — 2026-05-14 10:10 evidence →
121.29.4.80 scanner 42% 1x OSINT 16 2 ssh:bruteforce — 2026-05-14 07:04 evidence →
194.68.225.189 credential_harvester 38% 1x OSINT 14 1 ssh:bruteforce — 2026-05-14 07:47 evidence →
192.250.235.126 credential_harvester 38% 1x OSINT 14 1 ssh:bruteforce — 2026-05-14 07:39 evidence →
77.91.118.38 web_probe 35% 2 2 http:scan — 2026-05-14 09:50 evidence →
34.76.107.251 mysql_probe 22% 1 1 mysql:bruteforce — 2026-05-14 04:28 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds