IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
34 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
34 IPs
Below average
Total Events
19777
Below average by volume
Started / Ended
2026-03-04 12:43 — ongoing
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
195.178.110.137 credential_harvester 84% DROP2x OSINT 1779 3 ssh:bruteforce — 2026-07-17 17:16 evidence →
69.74.29.21 credential_harvester 79% 1x OSINT 2065 3 ssh:bruteforce — 2026-07-15 03:58 evidence →
45.153.34.15 credential_harvester 73% DROP1x OSINT 21475 3 ssh:bruteforce — 2026-07-17 07:12 evidence →
163.7.9.84 credential_harvester 72% 1x OSINT 869 3 ssh:bruteforce — 2026-07-11 12:08 evidence →
187.62.87.27 credential_harvester 71% 1x OSINT 1911 3 ssh:bruteforce — 2026-07-10 06:36 evidence →
4.239.243.30 credential_harvester 71% 1x OSINT 1679 3 ssh:bruteforce — 2026-07-10 20:05 evidence →
80.158.109.51 credential_harvester 71% 1x OSINT 1123 3 ssh:bruteforce — 2026-07-01 16:41 evidence →
220.127.148.6 credential_harvester 71% 1x OSINT 672 3 ssh:bruteforce — 2026-07-02 02:42 evidence →
158.51.96.38 data_exfiltrator 70% 1x OSINT 72 3 ssh:bruteforce — 2026-07-14 01:04 evidence →
42.51.37.22 credential_harvester 68% 1x OSINT 173 3 ssh:bruteforce — 2026-07-02 10:23 evidence →
101.126.67.255 scanner 53% 1x OSINT 156 2 ssh:bruteforce — 2026-07-02 10:22 evidence →
43.157.38.228 web_probe 53% 20 3 http:scan — 2026-07-17 04:42 evidence →
66.132.195.76 web_probe 53% 1x OSINT 9 3 http:scanssh:bruteforce — 2026-07-05 07:43 evidence →
43.164.190.124 web_probe 49% 17 3 http:scan — 2026-07-15 04:55 evidence →
49.51.196.42 web_probe 49% 17 3 http:scan — 2026-07-15 02:58 evidence →
43.153.119.119 web_probe 47% 12 3 http:scan — 2026-07-14 15:19 evidence →
43.173.1.57 web_probe 46% 12 3 http:scan — 2026-07-13 20:08 evidence →
45.79.5.11 scanner 45% 1x OSINT 61 3 ssh:bruteforce — 2026-07-06 08:33 evidence →
43.156.41.180 web_probe 43% 3 3 http:scan — 2026-07-13 11:18 evidence →
36.133.45.189 data_exfiltrator 42% 16 2 ssh:bruteforce — 2026-07-01 14:43 evidence →
43.164.196.244 web_probe 41% 17 3 http:scan — 2026-07-06 16:04 evidence →
43.157.153.236 web_probe 41% 15 3 http:scan — 2026-07-08 07:37 evidence →
43.153.10.83 web_probe 40% 9 3 http:scan — 2026-07-06 11:25 evidence →
124.156.226.179 web_probe 40% 9 3 http:scan — 2026-07-01 23:53 evidence →
69.229.227.44 opportunistic_bruter 38% 1x OSINT 46 2 ssh:bruteforce — 2026-07-02 08:15 evidence →
43.156.79.172 web_probe 36% 4 2 http:scan — 2026-07-17 13:07 evidence →
20.220.217.32 web_probe 32% 1x OSINT 38 2 http:scan — 2026-07-01 22:12 evidence →
104.43.131.157 web_probe 27% 1x OSINT 2 2 http:scan — 2026-07-01 23:01 evidence →
212.49.94.11 scanner 26% 50 2 ssh:bruteforce — 2026-07-11 10:51 evidence →
34.156.249.147 scanner 26% 42 2 ssh:bruteforce — 2026-07-02 06:31 evidence →
43.162.103.165 web_probe 25% 9 2 http:scan — 2026-07-09 23:08 evidence →
43.135.142.7 web_probe 25% 9 2 http:scan — 2026-07-02 07:13 evidence →
220.250.52.94 scanner 24% 27 2 ssh:bruteforce — 2026-07-02 11:41 evidence →
151.242.191.232 credential_probe 24% 46 2 ssh:bruteforce — 2026-07-02 12:28 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds