← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
12 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
Subnet
Country
Cloud Provider
Member Count
12 IPs
Below average
Total Events
471
Below average by volume
Started / Ended
2026-05-19 16:10 — ongoing
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
77.90.185.20 opportunistic_bruter 84% DROP2x OSINT 214 3 ssh:bruteforce 2026-07-17 00:43 evidence →
172.235.41.110 web_probe 57% 30 3 http:scanssh:bruteforce 2026-07-15 02:27 evidence →
35.241.166.201 mysql_bruter 56% 2x OSINT 14 3 ftp:bruteforcemysql:bruteforce 2026-07-10 07:30 evidence →
203.21.120.126 credential_harvester 56% 1x OSINT 661 2 ssh:bruteforce 2026-07-10 10:19 evidence →
102.220.160.39 proxy_abuser 52% DROP2x OSINT 91 2 ssh:bruteforce 2026-07-10 08:04 evidence →
43.153.96.79 web_probe 48% 12 3 http:scan 2026-07-15 02:07 evidence →
45.156.87.153 credential_harvester 47% DROP1x OSINT 53 2 ssh:bruteforce 2026-07-10 07:42 evidence →
45.79.207.252 scanner 46% 1x OSINT 76 3 ssh:bruteforce 2026-07-10 06:33 evidence →
38.191.248.41 interactive_operator 44% 68 2 ssh:bruteforce 2026-07-10 08:26 evidence →
118.196.79.21 scanner 39% 1x OSINT 10 2 ssh:bruteforce 2026-07-17 13:03 evidence →
116.62.163.56 scanner 26% 1x OSINT 6 2 ssh:bruteforce 2026-07-10 08:08 evidence →
154.12.62.158 web_probe 23% 2 2 http:scan 2026-07-10 06:55 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds