IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
32 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
32 IPs
Below average
Total Events
32682
Average by volume
Started / Ended
2026-03-09 11:54 — ongoing
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
45.153.34.114 credential_harvester 74% DROP1x OSINT 19505 3 ssh:bruteforce — 2026-05-18 09:29 evidence →
81.177.101.45 credential_harvester 71% 2x OSINT 534 2 ssh:bruteforce — 2026-05-18 05:55 evidence →
85.69.240.210 credential_harvester 67% 1x OSINT 628 2 ssh:bruteforce 210.240.69.85.rev.sfr.net 2026-05-18 01:16 evidence →
114.130.85.36 credential_harvester 67% 1x OSINT 369 2 ssh:bruteforce — 2026-05-18 12:18 evidence →
66.85.30.4 opportunistic_bruter 64% 1x OSINT 46 2 ssh:bruteforce — 2026-05-18 12:13 evidence →
150.109.10.85 opportunistic_bruter 63% 1x OSINT 46 2 ssh:bruteforce — 2026-05-18 10:20 evidence →
200.141.47.191 malware_dropper 63% 1x OSINT 46 2 ssh:bruteforce — 2026-05-18 04:33 evidence →
43.153.124.133 opportunistic_bruter 63% 1x OSINT 46 2 ssh:bruteforce — 2026-05-18 04:32 evidence →
36.141.79.94 scanner 60% 108 2 ssh:bruteforce — 2026-05-18 02:33 evidence →
104.43.56.65 credential_harvester 59% 1x OSINT 11352 2 ssh:bruteforce — 2026-05-18 11:26 evidence →
86.54.31.38 scanner 58% 3x OSINT 18 2 ftp:bruteforcehttp:scanssh:bruteforce — 2026-05-18 04:22 evidence →
101.126.89.35 scanner 58% 38 2 ssh:bruteforce — 2026-05-18 01:19 evidence →
71.6.232.23 scanner 55% 1x OSINT 20 3 ssh:bruteforce — 2026-05-18 04:46 evidence →
85.217.149.70 web_probe 53% 2x OSINT 5 2 http:scanssh:bruteforce — 2026-05-18 11:58 evidence →
43.166.244.251 web_probe 52% 9 3 http:scan — 2026-05-18 02:50 evidence →
43.153.107.22 web_probe 51% 6 3 http:scan — 2026-05-18 07:15 evidence →
74.48.69.130 credential_harvester 51% 1x OSINT 186 2 ssh:bruteforce — 2026-05-18 16:13 evidence →
43.134.98.88 web_probe 51% 3 3 http:scan — 2026-05-18 15:28 evidence →
43.130.31.17 web_probe 51% 6 3 http:scan — 2026-05-18 00:17 evidence →
64.62.156.10 scanner 51% 1x OSINT 19 2 http:scanssh:bruteforce — 2026-05-18 01:26 evidence →
198.235.24.102 scanner 50% 1x OSINT 11 2 http:scanssh:bruteforce — 2026-05-18 11:02 evidence →
142.171.24.198 credential_harvester 49% 1x OSINT 56 2 ssh:bruteforce — 2026-05-18 17:17 evidence →
103.112.62.144 credential_harvester 49% 1x OSINT 42 2 ssh:bruteforce — 2026-05-18 13:36 evidence →
5.188.183.218 credential_harvester 48% 1x OSINT 42 2 ssh:bruteforce — 2026-05-18 09:02 evidence →
107.6.164.190 credential_harvester 47% 1x OSINT 28 2 ssh:bruteforce — 2026-05-18 03:19 evidence →
205.185.125.209 credential_harvester 44% 40 2 ssh:bruteforce — 2026-05-18 11:28 evidence →
185.255.100.197 credential_harvester 43% VPN 48 2 ssh:bruteforce — 2026-05-18 06:57 evidence →
176.65.131.215 credential_harvester 43% 48 2 ssh:bruteforce — 2026-05-18 05:15 evidence →
64.89.163.159 mysql_bruter 42% DROP1x OSINT 14 2 mysql:bruteforce — 2026-05-18 14:21 evidence →
180.150.100.29 web_probe 40% 1x OSINT 2 2 http:scan — 2026-05-18 16:09 evidence →
54.166.112.195 scanner 39% 1x OSINT 8 2 ssh:bruteforce — 2026-05-18 00:59 evidence →
216.59.16.45 credential_harvester 32% 14 1 ssh:bruteforce — 2026-05-18 02:21 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds