IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
33 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
33 IPs
Below average
Total Events
11614
Below average by volume
Started / Ended
2026-05-13 13:29 — ongoing
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
103.143.238.100 credential_harvester 80% 1x OSINT 2375 3 ssh:bruteforce — 2026-06-13 19:47 evidence →
87.106.29.151 credential_harvester 71% 1x OSINT 1145 3 ssh:bruteforce — 2026-06-08 19:21 evidence →
89.47.53.19 credential_harvester 59% 1x OSINT 590 2 ssh:bruteforce — 2026-06-11 03:08 evidence →
66.228.53.78 web_probe 59% 62 3 http:scanssh:bruteforce — 2026-06-13 10:34 evidence →
64.89.163.138 mysql_bruter 57% DROP1x OSINT 21 3 mysql:bruteforce — 2026-06-16 04:17 evidence →
45.79.207.252 scanner 57% 2x OSINT 62 3 ssh:bruteforce — 2026-06-13 20:17 evidence →
34.53.192.169 mysql_bruter 55% 8 3 ftp:bruteforcemysql:bruteforce — 2026-06-13 23:45 evidence →
172.93.103.2 credential_harvester 53% 1x OSINT 780 2 ssh:bruteforce — 2026-06-16 02:52 evidence →
64.89.163.153 mysql_bruter 53% DROP1x OSINT 20 3 mysql:bruteforce — 2026-06-13 21:02 evidence →
172.96.172.91 credential_harvester 53% 1x OSINT 448 2 ssh:bruteforce — 2026-06-16 05:52 evidence →
103.161.34.59 credential_harvester 52% 1x OSINT 336 2 ssh:bruteforce — 2026-06-16 07:23 evidence →
176.65.131.192 credential_harvester 52% 1x OSINT 264 2 ssh:bruteforce — 2026-06-16 07:59 evidence →
8.222.181.172 mysql_bruter 50% 2x OSINT 26 2 mysql:bruteforcessh:bruteforce — 2026-06-13 16:05 evidence →
154.16.115.17 credential_harvester 49% 1x OSINT 724 2 ssh:bruteforce — 2026-06-13 14:10 evidence →
107.174.90.23 credential_harvester 49% 1x OSINT 460 2 ssh:bruteforce — 2026-06-13 22:57 evidence →
209.90.232.251 credential_harvester 48% 1x OSINT 490 2 ssh:bruteforce — 2026-06-13 18:36 evidence →
104.243.46.222 credential_harvester 48% 1x OSINT 482 2 ssh:bruteforce — 2026-06-13 14:37 evidence →
91.98.151.17 credential_harvester 48% 1x OSINT 336 2 ssh:bruteforce — 2026-06-13 22:11 evidence →
148.113.221.241 credential_harvester 48% 1x OSINT 448 2 ssh:bruteforce — 2026-06-13 15:20 evidence →
157.173.100.92 credential_harvester 48% 1x OSINT 322 2 ssh:bruteforce — 2026-06-13 21:19 evidence →
176.65.136.31 credential_harvester 48% 1x OSINT 280 2 ssh:bruteforce — 2026-06-13 22:07 evidence →
103.149.26.43 credential_harvester 48% 1x OSINT 462 2 ssh:bruteforce — 2026-06-13 10:22 evidence →
104.243.37.202 credential_harvester 47% 1x OSINT 374 2 ssh:bruteforce — 2026-06-13 07:59 evidence →
102.67.141.165 credential_harvester 46% 1x OSINT 154 2 ssh:bruteforce — 2026-06-13 20:59 evidence →
192.250.227.24 credential_harvester 42% 384 2 ssh:bruteforce — 2026-06-13 06:03 evidence →
179.61.232.244 credential_harvester 42% 1x OSINT 760 2 ssh:bruteforce — 2026-06-09 17:41 evidence →
194.120.230.28 credential_harvester 41% 358 2 ssh:bruteforce — 2026-06-12 21:56 evidence →
103.185.53.93 credential_harvester 40% 112 2 ssh:bruteforce — 2026-06-13 10:21 evidence →
62.210.38.102 credential_harvester 40% 306 2 ssh:bruteforce — 2026-06-12 07:04 evidence →
121.202.148.19 scanner 35% 167 2 ssh:bruteforce m121-202-148-19.smartone.com 2026-06-13 18:06 evidence →
196.218.240.133 scanner 30% 6 2 ssh:bruteforce — 2026-06-13 22:53 evidence →
172.239.64.84 web_probe 27% 10 2 http:scan — 2026-06-10 15:40 evidence →
177.92.162.241 credential_probe 21% 23 1 ssh:bruteforce — 2026-06-13 09:08 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds