IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
32 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
32 IPs
Below average
Total Events
22776
Below average by volume
Started / Ended
2026-04-07 04:59 — ongoing
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
158.174.210.161 credential_harvester 83% 1x OSINT 2087 3 ssh:bruteforce h-158-174-210-161.NA.cust.bahnhof.se 2026-06-16 11:25 evidence →
43.156.24.132 credential_harvester 69% 1x OSINT 944 2 ssh:bruteforce — 2026-06-16 17:09 evidence →
125.91.33.72 credential_harvester 68% 1x OSINT 952 2 ssh:bruteforce — 2026-06-16 12:29 evidence →
95.58.255.251 credential_harvester 68% 1x OSINT 1085 2 ssh:bruteforce 95.58.255.251.static.telecom.kz 2026-06-16 05:29 evidence →
36.64.131.68 credential_harvester 67% 1x OSINT 437 2 ssh:bruteforce — 2026-06-16 16:17 evidence →
218.207.25.249 credential_harvester 67% 1x OSINT 481 2 ssh:bruteforce — 2026-06-16 11:31 evidence →
182.43.235.218 scanner 67% 1x OSINT 461 2 ssh:bruteforce — 2026-06-16 12:27 evidence →
105.233.67.36 credential_harvester 66% 1x OSINT 302 2 ssh:bruteforce — 2026-06-16 11:17 evidence →
147.185.132.57 web_probe 65% 1x OSINT 10 3 http:scanssh:bruteforce — 2026-06-16 15:24 evidence →
180.76.170.111 scanner 65% 1x OSINT 110 2 ssh:bruteforce — 2026-06-16 15:38 evidence →
198.235.24.47 web_probe 65% 1x OSINT 12 3 http:scanssh:bruteforce — 2026-06-16 06:19 evidence →
198.235.24.123 scanner 65% 1x OSINT 13 3 http:scanssh:bruteforce — 2026-06-16 04:33 evidence →
111.35.7.46 scanner 63% 55 3 ssh:bruteforce — 2026-06-16 04:30 evidence →
152.32.254.222 credential_harvester 59% 1x OSINT 2381 2 ssh:bruteforce — 2026-06-16 12:17 evidence →
45.156.87.216 credential_harvester 58% DROP1x OSINT 13052 2 ssh:bruteforce — 2026-06-16 08:25 evidence →
64.89.163.91 mysql_bruter 53% DROP 30 3 mysql:bruteforce — 2026-06-16 18:31 evidence →
124.156.157.91 web_probe 53% 15 3 http:scan — 2026-06-16 14:56 evidence →
43.130.78.203 web_probe 52% 9 3 http:scan — 2026-06-16 08:56 evidence →
49.51.141.76 web_probe 51% 7 3 http:scan — 2026-06-16 04:59 evidence →
50.46.141.125 credential_harvester 51% 1x OSINT 39 2 ssh:bruteforce — 2026-06-16 16:56 evidence →
162.243.174.209 scanner 51% 12 3 ssh:bruteforce — 2026-06-16 20:22 evidence →
85.217.149.55 web_probe 50% 1x OSINT 6 2 http:scanssh:bruteforce — 2026-06-16 20:02 evidence →
185.134.49.116 credential_harvester 49% 1x OSINT 84 2 ssh:bruteforce — 2026-06-16 09:03 evidence →
81.19.216.85 scanner 49% 1x OSINT 3 2 http:scanssh:bruteforce — 2026-06-16 17:13 evidence →
114.66.29.48 mysql_bruter 45% 1x OSINT 131 2 mysql:bruteforce — 2026-06-16 06:09 evidence →
34.156.194.111 scanner 41% 1x OSINT 19 2 ssh:bruteforce — 2026-06-16 05:51 evidence →
185.100.87.136 scanner 41% 1x OSINT 20 2 ssh:bruteforce — 2026-06-16 14:54 evidence →
43.134.104.17 web_probe 36% 5 2 http:scan — 2026-06-16 12:57 evidence →
43.165.167.72 web_probe 36% 4 2 http:scan — 2026-06-16 15:33 evidence →
103.77.240.247 scanner 34% 6 2 ssh:bruteforce — 2026-06-16 18:03 evidence →
34.77.201.101 ftp_probe 32% 4 2 ftp:bruteforce — 2026-06-16 06:41 evidence →
58.19.12.142 credential_probe 23% 5 1 ssh:bruteforce — 2026-06-16 13:53 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds