IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
33 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
33 IPs
Below average
Total Events
23394
Below average by volume
Started / Ended
2026-03-07 21:26 — ongoing
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
138.124.158.150 credential_harvester 84% 1x OSINT 1584 3 ssh:bruteforce — 2026-05-27 12:27 evidence →
154.221.28.214 credential_harvester 84% 1x OSINT 1381 3 ssh:bruteforce — 2026-05-27 09:55 evidence →
155.4.245.222 credential_harvester 83% 1x OSINT 851 3 ssh:bruteforce — 2026-05-27 10:14 evidence →
179.57.170.71 credential_harvester 83% 1x OSINT 640 3 ssh:bruteforce — 2026-05-27 06:47 evidence →
34.128.77.56 credential_harvester 68% 1x OSINT 603 2 ssh:bruteforce — 2026-05-27 10:46 evidence →
80.94.92.186 credential_harvester 68% DROP2x OSINT 8154 3 ssh:bruteforce — 2026-05-27 17:07 evidence →
213.209.159.142 credential_harvester 67% DROP2x OSINT 7478 3 ssh:bruteforce — 2026-05-23 03:24 evidence →
180.213.44.242 credential_harvester 67% 1x OSINT 368 2 ssh:bruteforce — 2026-05-27 08:33 evidence →
103.56.148.173 credential_harvester 66% 1x OSINT 270 2 ssh:bruteforce — 2026-05-27 09:51 evidence →
196.196.150.124 credential_harvester 66% 1x OSINT 254 2 ssh:bruteforce — 2026-05-27 07:07 evidence →
103.189.234.9 credential_harvester 65% 1x OSINT 198 2 ssh:bruteforce — 2026-05-27 02:44 evidence →
14.103.112.228 scanner 64% 1x OSINT 70 2 ssh:bruteforce — 2026-05-27 11:51 evidence →
205.210.31.49 scanner 64% 1x OSINT 27 3 http:scanssh:bruteforce — 2026-05-25 21:09 evidence →
118.145.237.236 scanner 64% 1x OSINT 74 2 ssh:bruteforce — 2026-05-27 03:19 evidence →
138.113.0.63 opportunistic_bruter 63% 1x OSINT 46 2 ssh:bruteforce — 2026-05-27 04:08 evidence →
42.51.33.162 scanner 63% 1x OSINT 29 2 ssh:bruteforce — 2026-05-27 09:26 evidence →
103.182.132.154 credential_harvester 62% 1x OSINT 829 2 ssh:bruteforce — 2026-05-24 02:56 evidence →
152.32.189.59 credential_harvester 59% 1x OSINT 170 2 ssh:bruteforce — 2026-05-24 01:39 evidence →
38.70.51.226 scanner 57% 1x OSINT 32 3 ssh:bruteforce — 2026-05-27 10:15 evidence →
198.177.125.186 web_probe 56% 1x OSINT 4 3 http:scan — 2026-05-27 07:07 evidence →
89.37.117.103 credential_harvester 53% 1x OSINT 452 2 ssh:bruteforce — 2026-05-27 15:22 evidence →
43.157.180.116 web_probe 52% 7 3 http:scan — 2026-05-27 11:28 evidence →
147.45.50.147 credential_harvester 51% 1x OSINT 45 2 ssh:bruteforce — 2026-05-27 05:47 evidence →
62.210.199.83 credential_harvester 48% 474 2 ssh:bruteforce — 2026-05-27 15:27 evidence →
173.255.225.25 scanner 45% 7 2 http:scanssh:bruteforce — 2026-05-27 11:08 evidence →
209.141.33.207 credential_harvester 45% 76 2 ssh:bruteforce — 2026-05-27 14:40 evidence →
213.199.52.47 credential_harvester 44% 42 2 ssh:bruteforce — 2026-05-27 15:13 evidence →
34.79.100.73 ftp_probe 41% 7 2 ftp:bruteforcemysql:bruteforce — 2026-05-27 14:15 evidence →
37.19.197.137 web_probe 40% VPN1x OSINT 2 2 http:scan — 2026-05-27 07:58 evidence →
183.129.249.4 scanner 39% 1x OSINT 6 2 ssh:bruteforce — 2026-05-27 10:14 evidence →
14.103.115.208 scanner 36% 1x OSINT 49 2 ssh:bruteforce — 2026-05-23 04:24 evidence →
172.239.64.155 web_probe 35% 2 2 http:scan — 2026-05-27 11:15 evidence →
119.148.8.66 scanner 33% 4 2 ssh:bruteforce — 2026-05-27 05:44 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds