IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
33 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
33 IPs
Below average
Total Events
22513
Below average by volume
Started / Ended
2026-06-25 23:08 — ongoing
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
196.196.150.99 credential_harvester 79% 1x OSINT 1144 3 ssh:bruteforce — 2026-07-14 21:46 evidence →
130.12.180.51 data_exfiltrator 78% DROP 6861 3 ssh:bruteforce — 2026-07-17 03:23 evidence →
209.99.191.19 credential_harvester 74% DROP1x OSINT 2634 3 ssh:bruteforce — 2026-07-12 09:30 evidence →
20.13.164.162 credential_harvester 73% 1x OSINT 586 3 ssh:bruteforce — 2026-07-12 08:15 evidence →
154.90.70.254 credential_harvester 61% DROP1x OSINT 237 3 ssh:bruteforce — 2026-07-12 02:37 evidence →
45.156.128.128 web_probe 60% 2x OSINT 10 3 http:scan — 2026-07-17 07:22 evidence →
151.243.11.245 web_probe 60% 1x OSINT 42 3 http:scan — 2026-07-17 21:28 evidence →
45.205.1.223 web_probe 60% DROP1x OSINT 44 3 http:scan — 2026-07-17 16:09 evidence →
49.51.199.112 credential_harvester 59% 1x OSINT 525 2 ssh:bruteforce — 2026-07-13 02:05 evidence →
91.92.42.172 credential_harvester 58% DROP1x OSINT 7530 2 ssh:bruteforce — 2026-07-17 06:49 evidence →
65.49.1.212 scanner 57% 1x OSINT 37 3 http:scanssh:bruteforce — 2026-07-12 04:58 evidence →
135.116.20.17 credential_harvester 57% 1x OSINT 317 2 ssh:bruteforce — 2026-07-12 09:59 evidence →
62.133.60.31 credential_harvester 56% 2x OSINT 40 3 ssh:bruteforce — 2026-07-14 13:59 evidence →
64.89.163.164 mysql_bruter 55% DROP 571 3 mysql:bruteforce — 2026-07-15 18:45 evidence →
178.105.152.163 credential_harvester 54% 669 2 ssh:bruteforce — 2026-07-12 09:33 evidence →
64.89.163.170 mysql_bruter 52% DROP 34 3 mysql:bruteforce — 2026-07-17 01:12 evidence →
66.132.195.64 scanner 52% 29 3 http:scanssh:bruteforce — 2026-07-12 02:47 evidence →
50.6.197.105 credential_harvester 50% 1x OSINT 1088 2 ssh:bruteforce — 2026-07-15 13:58 evidence →
198.199.106.159 credential_harvester 49% 1x OSINT 1142 2 ssh:bruteforce — 2026-07-15 04:13 evidence →
179.61.232.244 credential_harvester 47% 1x OSINT 1180 2 ssh:bruteforce — 2026-07-14 02:25 evidence →
45.120.126.66 scanner 45% 1x OSINT 10 3 ssh:bruteforce — 2026-07-12 04:59 evidence →
152.32.171.184 credential_probe 45% 74 3 ssh:bruteforce — 2026-07-13 14:21 evidence →
80.66.83.43 scanner 44% 114 3 ssh:bruteforce — 2026-07-12 08:44 evidence →
186.233.184.67 credential_harvester 42% 1326 2 ssh:bruteforce — 2026-07-14 01:14 evidence →
62.210.189.225 credential_harvester 42% 1244 2 ssh:bruteforce — 2026-07-14 00:40 evidence →
194.120.230.72 credential_harvester 42% 1372 2 ssh:bruteforce — 2026-07-13 19:39 evidence →
199.127.62.250 credential_harvester 39% 940 2 ssh:bruteforce — 2026-07-12 02:21 evidence →
162.144.84.221 credential_harvester 37% 272 2 ssh:bruteforce — 2026-07-12 03:46 evidence →
103.27.176.143 web_probe 34% 1x OSINT 28 2 http:scan — 2026-07-12 06:46 evidence →
159.65.143.47 credential_probe 34% 2x OSINT 30 2 ssh:bruteforce — 2026-07-12 01:54 evidence →
5.252.154.55 credential_probe 31% 1x OSINT 15 2 ssh:bruteforce — 2026-07-13 00:41 evidence →
103.82.92.171 credential_probe 30% 1x OSINT 23 2 ssh:bruteforce — 2026-07-12 08:18 evidence →
89.252.185.127 credential_probe 26% 15 2 ssh:bruteforce — 2026-07-13 00:42 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds