IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
33 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
33 IPs
Below average
Total Events
22300
Below average by volume
Started / Ended
2026-02-27 22:43 — ongoing
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
221.161.235.168 credential_harvester 80% 1x OSINT 2727 3 ssh:bruteforce — 2026-07-15 14:59 evidence →
139.59.146.150 credential_harvester 72% 1x OSINT 1085 3 ssh:bruteforce — 2026-07-11 11:49 evidence →
144.202.92.17 web_probe 69% 1x OSINT 102 3 http:scanssh:bruteforce — 2026-07-17 19:00 evidence →
14.18.236.71 scanner 55% 1x OSINT 379 2 ssh:bruteforce — 2026-07-02 18:06 evidence →
138.124.30.187 opportunistic_bruter 55% 1x OSINT 365 2 ssh:bruteforce — 2026-07-04 09:51 evidence →
104.194.9.81 credential_harvester 54% 1x OSINT 1214 2 ssh:bruteforce — 2026-07-17 19:01 evidence →
109.236.86.20 credential_harvester 54% 1x OSINT 1074 2 ssh:bruteforce — 2026-07-17 17:09 evidence →
147.185.132.60 scanner 54% 1x OSINT 20 3 http:scanssh:bruteforce — 2026-07-02 16:49 evidence →
148.153.121.224 credential_harvester 54% 1x OSINT 1320 2 ssh:bruteforce — 2026-07-17 12:03 evidence →
154.16.119.22 credential_harvester 53% 1x OSINT 1114 2 ssh:bruteforce — 2026-07-17 06:41 evidence →
104.243.37.202 credential_harvester 53% 1x OSINT 696 2 ssh:bruteforce — 2026-07-17 11:05 evidence →
107.173.122.15 credential_harvester 53% 1x OSINT 522 2 ssh:bruteforce — 2026-07-17 16:07 evidence →
128.0.104.44 credential_harvester 53% 1x OSINT 1280 2 ssh:bruteforce — 2026-07-17 01:15 evidence →
103.176.90.41 credential_harvester 53% 1x OSINT 980 2 ssh:bruteforce — 2026-07-17 00:18 evidence →
139.59.83.32 malware_dropper 52% 1x OSINT 92 2 ssh:bruteforce — 2026-07-02 07:51 evidence →
148.113.221.114 credential_harvester 50% 1x OSINT 848 2 ssh:bruteforce — 2026-07-15 11:37 evidence →
148.153.245.161 credential_harvester 48% 1x OSINT 1182 2 ssh:bruteforce — 2026-07-14 13:04 evidence →
144.217.74.127 credential_harvester 48% 1x OSINT 1060 2 ssh:bruteforce — 2026-07-14 09:19 evidence →
149.56.241.206 credential_harvester 45% 826 2 ssh:bruteforce — 2026-07-15 10:10 evidence →
103.112.62.144 credential_harvester 43% 616 2 ssh:bruteforce — 2026-07-15 02:04 evidence →
158.69.227.40 credential_harvester 43% 1036 2 ssh:bruteforce — 2026-07-14 04:49 evidence →
104.243.46.222 credential_harvester 42% 860 2 ssh:bruteforce — 2026-07-14 03:29 evidence →
101.32.208.70 web_probe 40% 13 3 http:scan — 2026-07-02 21:02 evidence →
107.172.88.206 credential_harvester 39% 476 2 ssh:bruteforce — 2026-07-13 03:22 evidence →
154.16.115.17 credential_harvester 39% 1046 2 ssh:bruteforce — 2026-07-12 09:22 evidence →
104.194.10.248 credential_harvester 39% 1310 2 ssh:bruteforce — 2026-07-12 05:27 evidence →
102.129.200.117 credential_harvester 39% 978 2 ssh:bruteforce — 2026-07-12 04:52 evidence →
148.113.221.241 credential_harvester 39% 840 2 ssh:bruteforce — 2026-07-12 05:07 evidence →
103.185.53.93 credential_harvester 38% 252 2 ssh:bruteforce — 2026-07-13 02:48 evidence →
104.243.38.174 credential_harvester 38% 696 2 ssh:bruteforce — 2026-07-12 00:53 evidence →
103.149.26.43 credential_harvester 38% 672 2 ssh:bruteforce — 2026-07-12 00:00 evidence →
142.44.247.134 credential_harvester 37% 1078 2 ssh:bruteforce — 2026-07-04 10:48 evidence →
141.95.34.214 credential_harvester 36% 748 2 ssh:bruteforce — 2026-07-06 12:58 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds