IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
32 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
32 IPs
Below average
Total Events
3867
Below average by volume
Started / Ended
2026-07-01 22:20 — ongoing
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
195.178.110.137 credential_harvester 84% DROP2x OSINT 1779 3 ssh:bruteforce — 2026-07-17 17:16 evidence →
49.51.199.112 credential_harvester 59% 1x OSINT 525 2 ssh:bruteforce — 2026-07-13 02:05 evidence →
66.132.195.63 web_probe 57% 1x OSINT 9 3 http:scanssh:bruteforce — 2026-07-13 04:01 evidence →
14.103.115.234 scanner 53% 185 2 ssh:bruteforce — 2026-07-13 01:19 evidence →
193.110.157.47 credential_harvester 50% 1x OSINT 1526 2 ssh:bruteforce — 2026-07-13 02:03 evidence →
43.153.62.161 web_probe 44% 11 3 http:scan — 2026-07-13 03:01 evidence →
162.214.159.200 credential_harvester 42% 1x OSINT 48 2 ssh:bruteforce — 2026-07-17 01:05 evidence →
103.30.4.53 web_probe 37% 8 2 http:scan — 2026-07-17 19:47 evidence →
162.241.239.241 credential_harvester 34% 1x OSINT 30 2 ssh:bruteforce — 2026-07-13 02:45 evidence →
162.144.34.123 credential_probe 32% 1x OSINT 31 2 ssh:bruteforce — 2026-07-13 01:53 evidence →
185.201.212.242 credential_probe 32% 1x OSINT 28 2 ssh:bruteforce — 2026-07-13 04:08 evidence →
162.241.132.172 credential_probe 32% 1x OSINT 26 2 ssh:bruteforce — 2026-07-13 03:34 evidence →
108.179.221.68 credential_probe 32% 1x OSINT 26 2 ssh:bruteforce — 2026-07-13 01:49 evidence →
132.148.155.138 credential_probe 32% 1x OSINT 23 2 ssh:bruteforce — 2026-07-13 04:05 evidence →
132.148.142.226 credential_probe 31% 1x OSINT 23 2 ssh:bruteforce — 2026-07-13 03:32 evidence →
203.146.102.66 credential_probe 31% 1x OSINT 23 2 ssh:bruteforce — 2026-07-13 01:26 evidence →
162.240.44.39 credential_probe 31% 1x OSINT 20 2 ssh:bruteforce — 2026-07-13 01:36 evidence →
162.144.105.39 credential_probe 31% 1x OSINT 18 2 ssh:bruteforce — 2026-07-13 02:49 evidence →
162.241.177.22 credential_probe 31% 1x OSINT 20 2 ssh:bruteforce — 2026-07-13 00:03 evidence →
67.220.64.66 credential_probe 31% 1x OSINT 18 2 ssh:bruteforce — 2026-07-13 00:33 evidence →
162.241.129.208 credential_probe 31% 1x OSINT 18 2 ssh:bruteforce — 2026-07-13 00:13 evidence →
162.240.20.137 credential_probe 31% 1x OSINT 15 2 ssh:bruteforce — 2026-07-13 03:39 evidence →
74.91.200.217 credential_probe 31% 1x OSINT 15 2 ssh:bruteforce — 2026-07-13 03:14 evidence →
198.12.251.137 credential_probe 31% 1x OSINT 15 2 ssh:bruteforce — 2026-07-13 03:06 evidence →
192.169.180.166 credential_probe 31% 1x OSINT 15 2 ssh:bruteforce — 2026-07-13 01:52 evidence →
64.202.186.161 credential_probe 31% 1x OSINT 15 2 ssh:bruteforce — 2026-07-13 01:32 evidence →
192.169.202.129 credential_probe 31% 1x OSINT 15 2 ssh:bruteforce — 2026-07-13 00:50 evidence →
5.252.154.55 credential_probe 31% 1x OSINT 15 2 ssh:bruteforce — 2026-07-13 00:41 evidence →
162.215.213.210 credential_probe 31% 1x OSINT 15 2 ssh:bruteforce — 2026-07-13 00:30 evidence →
160.251.139.91 credential_probe 30% 1x OSINT 10 2 ssh:bruteforce — 2026-07-13 00:32 evidence →
159.89.2.27 credential_probe 26% 18 2 ssh:bruteforce — 2026-07-13 03:21 evidence →
89.252.185.127 credential_probe 26% 15 2 ssh:bruteforce — 2026-07-13 00:42 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds