IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
32 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
32 IPs
Below average
Total Events
5726
Below average by volume
Started / Ended
2026-04-19 17:04 — ongoing
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
195.178.110.227 interactive_operator 79% DROP2x OSINT 3159 3 ssh:bruteforce — 2026-07-14 16:57 evidence →
151.243.11.245 web_probe 60% 1x OSINT 42 3 http:scan — 2026-07-17 21:28 evidence →
45.205.1.223 web_probe 60% DROP1x OSINT 44 3 http:scan — 2026-07-17 16:09 evidence →
45.14.134.197 credential_harvester 59% 1x OSINT 1292 2 ssh:bruteforce — 2026-07-12 09:20 evidence →
187.154.144.166 credential_harvester 59% 1x OSINT 1202 2 ssh:bruteforce — 2026-07-12 08:14 evidence →
65.49.1.80 web_probe 57% 1x OSINT 33 3 http:scanssh:bruteforce — 2026-07-12 06:06 evidence →
135.116.20.17 credential_harvester 57% 1x OSINT 317 2 ssh:bruteforce — 2026-07-12 09:59 evidence →
45.156.128.128 web_probe 57% 1x OSINT 10 3 http:scan — 2026-07-17 07:22 evidence →
43.161.234.148 web_probe 53% 14 3 http:scan — 2026-07-17 17:23 evidence →
193.110.157.47 credential_harvester 50% 1x OSINT 1526 2 ssh:bruteforce — 2026-07-13 02:03 evidence →
43.154.140.188 web_probe 49% 14 3 http:scan — 2026-07-15 15:54 evidence →
43.166.238.12 web_probe 46% 9 3 http:scan — 2026-07-14 03:40 evidence →
45.120.126.66 scanner 45% 1x OSINT 10 3 ssh:bruteforce — 2026-07-12 04:59 evidence →
43.159.140.236 web_probe 44% 14 3 http:scan — 2026-07-13 02:15 evidence →
162.214.159.200 credential_harvester 42% 1x OSINT 48 2 ssh:bruteforce — 2026-07-17 01:05 evidence →
35.241.186.160 ftp_probe 39% 3 2 ftp:bruteforcemysql:bruteforce — 2026-07-17 00:52 evidence →
162.144.34.123 credential_probe 32% 1x OSINT 31 2 ssh:bruteforce — 2026-07-13 01:53 evidence →
108.179.221.68 credential_probe 31% 1x OSINT 26 2 ssh:bruteforce — 2026-07-13 01:49 evidence →
203.146.102.66 credential_probe 31% 1x OSINT 23 2 ssh:bruteforce — 2026-07-13 01:26 evidence →
162.240.44.39 credential_probe 31% 1x OSINT 20 2 ssh:bruteforce — 2026-07-13 01:36 evidence →
162.241.177.22 credential_probe 31% 1x OSINT 20 2 ssh:bruteforce — 2026-07-13 00:03 evidence →
67.220.64.66 credential_probe 31% 1x OSINT 18 2 ssh:bruteforce — 2026-07-13 00:33 evidence →
162.241.129.208 credential_probe 31% 1x OSINT 18 2 ssh:bruteforce — 2026-07-13 00:13 evidence →
192.169.180.166 credential_probe 31% 1x OSINT 15 2 ssh:bruteforce — 2026-07-13 01:52 evidence →
64.202.186.161 credential_probe 31% 1x OSINT 15 2 ssh:bruteforce — 2026-07-13 01:32 evidence →
192.169.202.129 credential_probe 30% 1x OSINT 15 2 ssh:bruteforce — 2026-07-13 00:50 evidence →
5.252.154.55 credential_probe 30% 1x OSINT 15 2 ssh:bruteforce — 2026-07-13 00:41 evidence →
162.215.213.210 credential_probe 30% 1x OSINT 15 2 ssh:bruteforce — 2026-07-13 00:30 evidence →
103.82.92.171 credential_probe 30% 1x OSINT 23 2 ssh:bruteforce — 2026-07-12 08:18 evidence →
160.251.139.91 credential_probe 30% 1x OSINT 10 2 ssh:bruteforce — 2026-07-13 00:32 evidence →
207.175.36.236 scanner 27% 43 2 ssh:bruteforce — 2026-07-12 06:05 evidence →
89.252.185.127 credential_probe 26% 15 2 ssh:bruteforce — 2026-07-13 00:42 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds