← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
12 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
Subnet
Country
Cloud Provider
Member Count
12 IPs
Below average
Total Events
2242
Below average by volume
Started / Ended
2026-05-05 05:06 — ongoing
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
118.196.92.141 scanner 75% 1x OSINT 425 3 ssh:bruteforce 2026-09-11 17:02 evidence →
147.185.132.60 scanner 70% 2x OSINT 34 3 http:scanssh:bruteforce 2026-09-15 00:19 evidence →
139.59.146.150 credential_harvester 67% 1826 3 ssh:bruteforce 2026-08-03 07:17 evidence →
159.223.156.159 credential_harvester 65% 323 3 ssh:bruteforce 2026-07-05 03:42 evidence →
139.59.83.32 malware_dropper 63% 115 3 ssh:bruteforce 2026-07-18 13:48 evidence →
14.18.236.71 scanner 55% 1x OSINT 379 2 ssh:bruteforce 2026-07-02 18:06 evidence →
138.124.30.187 credential_harvester 52% 1518 2 ssh:bruteforce 2026-07-29 10:44 evidence →
186.233.118.22 credential_harvester 50% 548 2 ssh:bruteforce 2026-07-02 09:47 evidence →
51.159.104.219 credential_harvester 36% 964 2 ssh:bruteforce 2026-07-13 02:49 evidence →
194.165.16.161 scanner 32% 1x OSINT 227 2 ssh:bruteforce 2026-08-27 14:11 evidence →
192.3.153.213 credential_harvester 32% 84 2 ssh:bruteforce 2026-07-12 01:13 evidence →
179.61.192.3 credential_harvester 30% 28 2 ssh:bruteforce 2026-07-02 23:52 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds
{# Cloudflare Web Analytics — cookieless, public pages only. The context processor withholds the token from authenticated requests. #}