← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
12 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
Subnet
Country
Cloud Provider
Member Count
12 IPs
Below average
Total Events
3179
Below average by volume
Started / Ended
2026-03-10 16:02 — ongoing
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
50.225.176.238 credential_harvester 84% 1x OSINT 1705 3 ssh:bruteforce 2026-05-14 14:09 evidence →
98.70.48.241 credential_harvester 82% 1x OSINT 530 3 ssh:bruteforce 2026-05-14 06:29 evidence →
45.148.10.152 opportunistic_bruter 68% DROP1x OSINT 155 3 ssh:bruteforce 2026-05-14 19:03 evidence →
45.148.10.147 opportunistic_bruter 67% DROP1x OSINT 165 3 ssh:bruteforce 2026-05-14 07:04 evidence →
43.160.206.186 credential_harvester 67% 1x OSINT 522 2 ssh:bruteforce 2026-05-14 11:07 evidence →
64.89.163.179 mysql_bruter 56% DROP1x OSINT 12 3 mysql:bruteforce 2026-05-14 19:03 evidence →
80.66.83.43 scanner 53% 60 3 ssh:bruteforce 2026-05-14 11:45 evidence →
43.160.240.216 web_probe 50% 4 3 http:scan 2026-05-14 08:57 evidence →
43.161.217.205 web_probe 50% 3 3 http:scan 2026-05-14 04:19 evidence →
34.76.17.53 scanner 41% 1x OSINT 18 2 ssh:bruteforce 2026-05-14 07:51 evidence →
45.156.129.131 web_probe 40% 1x OSINT 2 2 http:scan 2026-05-14 18:53 evidence →
34.38.211.183 ftp_probe 40% 3 2 ftp:bruteforcemysql:bruteforce 2026-05-14 14:28 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds