IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
34 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
34 IPs
Below average
Total Events
17267
Below average by volume
Started / Ended
2026-03-01 22:24 — ongoing
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
147.50.231.135 credential_harvester 83% 1x OSINT 1949 3 ssh:bruteforce idc-147-50-231-135.customer.csloxinfo.com 2026-05-30 04:07 evidence →
102.88.137.80 credential_harvester 69% 1x OSINT 4878 2 ssh:bruteforce — 2026-05-30 14:21 evidence →
69.49.246.176 credential_harvester 68% 1x OSINT 392 2 ssh:bruteforce 69-49-246-176.webhostbox.net 2026-05-30 19:31 evidence →
103.168.135.187 credential_harvester 56% 1x OSINT 1749 2 ssh:bruteforce — 2026-05-23 05:36 evidence →
106.37.72.234 scanner 56% 1x OSINT 293 2 ssh:bruteforce — 2026-05-24 14:48 evidence →
110.14.190.217 credential_harvester 55% 1x OSINT 491 2 ssh:bruteforce — 2026-04-12 11:44 evidence →
152.32.205.153 opportunistic_bruter 54% 1x OSINT 46 1 ssh:bruteforce — 2026-05-30 07:47 evidence →
142.44.247.134 credential_harvester 53% 1x OSINT 406 2 ssh:bruteforce — 2026-05-30 19:03 evidence →
102.129.200.101 credential_harvester 52% 1x OSINT 442 2 ssh:bruteforce — 2026-05-30 13:07 evidence →
104.243.46.222 credential_harvester 51% 1x OSINT 230 2 ssh:bruteforce — 2026-05-30 16:12 evidence →
107.170.247.81 credential_harvester 51% 1x OSINT 428 2 ssh:bruteforce — 2026-05-30 00:28 evidence →
128.0.104.44 credential_harvester 49% 1x OSINT 552 2 ssh:bruteforce — 2026-05-28 18:42 evidence →
128.0.104.39 credential_harvester 49% 1x OSINT 492 2 ssh:bruteforce — 2026-05-28 20:40 evidence →
148.153.121.223 credential_harvester 49% 1x OSINT 492 2 ssh:bruteforce — 2026-05-28 19:48 evidence →
148.153.121.224 credential_harvester 49% 1x OSINT 522 2 ssh:bruteforce — 2026-05-28 17:12 evidence →
102.129.186.87 credential_harvester 49% 1x OSINT 476 2 ssh:bruteforce — 2026-05-28 13:40 evidence →
102.129.200.117 credential_harvester 48% 1x OSINT 278 2 ssh:bruteforce — 2026-05-28 19:01 evidence →
104.194.9.81 credential_harvester 48% 1x OSINT 360 2 ssh:bruteforce — 2026-05-28 12:06 evidence →
148.153.245.161 credential_harvester 48% 1x OSINT 440 2 ssh:bruteforce — 2026-05-28 05:56 evidence →
103.75.71.17 credential_harvester 48% 1x OSINT 316 2 ssh:bruteforce — 2026-05-28 11:14 evidence →
104.243.38.174 credential_harvester 48% 1x OSINT 402 2 ssh:bruteforce — 2026-05-28 05:21 evidence →
107.174.90.23 credential_harvester 48% 1x OSINT 208 2 ssh:bruteforce — 2026-05-28 17:36 evidence →
141.95.34.214 credential_harvester 47% 1x OSINT 426 2 ssh:bruteforce — 2026-05-27 15:58 evidence →
103.75.71.22 credential_harvester 46% 388 2 ssh:bruteforce — 2026-05-30 00:34 evidence →
103.161.34.59 credential_harvester 46% 1x OSINT 98 2 ssh:bruteforce — 2026-05-28 16:39 evidence →
107.172.88.206 credential_harvester 46% 1x OSINT 182 2 ssh:bruteforce — 2026-05-28 02:12 evidence →
139.180.163.29 credential_harvester 46% 1x OSINT 194 2 ssh:bruteforce — 2026-05-27 22:29 evidence →
107.173.122.15 credential_harvester 46% 1x OSINT 158 2 ssh:bruteforce — 2026-05-28 02:57 evidence →
136.248.242.166 credential_harvester 45% 1x OSINT 176 1 ssh:bruteforce — 2026-05-23 23:41 evidence →
107.6.182.109 credential_harvester 40% 88 2 ssh:bruteforce — 2026-05-28 03:38 evidence →
104.243.37.202 credential_harvester 40% 150 2 ssh:bruteforce — 2026-05-27 11:01 evidence →
103.176.90.41 credential_harvester 40% 1x OSINT 378 2 ssh:bruteforce — 2026-05-22 03:04 evidence →
104.237.57.186 credential_harvester 34% 1x OSINT 14 1 ssh:bruteforce — 2026-05-28 20:13 evidence →
123.30.240.7 credential_harvester 33% 118 2 ssh:bruteforce — 2026-05-19 11:08 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds