IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
43 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
43 IPs
Below average
Total Events
3955
Below average by volume
Started / Ended
2026-07-15 00:13 — ongoing
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
111.47.243.219 credential_harvester 83% 1x OSINT 1808 3 ssh:bruteforce — 2026-07-17 00:41 evidence →
103.165.206.238 credential_harvester 79% 1x OSINT 1520 3 ssh:bruteforce — 2026-07-15 01:04 evidence →
65.49.1.142 scanner 63% 1x OSINT 54 3 http:scanssh:bruteforce — 2026-07-15 01:55 evidence →
223.83.114.88 scanner 58% 2x OSINT 97 3 ssh:bruteforce — 2026-07-15 08:30 evidence →
64.89.163.91 mysql_bruter 53% DROP 58 3 mysql:bruteforce — 2026-07-17 06:32 evidence →
137.220.158.188 opportunistic_bruter 43% 110 2 ssh:bruteforce — 2026-07-15 05:15 evidence →
111.203.166.201 opportunistic_bruter 43% 50 2 ssh:bruteforce — 2026-07-15 16:48 evidence →
34.61.190.213 opportunistic_bruter 42% 50 2 ssh:bruteforce — 2026-07-15 14:20 evidence →
103.45.66.22 opportunistic_bruter 42% DROP 40 2 ssh:bruteforce — 2026-07-15 17:25 evidence →
4.213.72.79 opportunistic_bruter 42% 40 2 ssh:bruteforce — 2026-07-15 17:23 evidence →
20.197.11.4 opportunistic_bruter 42% 40 2 ssh:bruteforce — 2026-07-15 16:05 evidence →
14.204.41.80 opportunistic_bruter 42% 40 2 ssh:bruteforce — 2026-07-15 14:42 evidence →
20.199.24.165 opportunistic_bruter 42% 40 2 ssh:bruteforce — 2026-07-15 14:16 evidence →
82.115.13.174 opportunistic_bruter 42% 60 2 ssh:bruteforce — 2026-07-15 04:03 evidence →
20.244.84.86 opportunistic_bruter 42% 50 2 ssh:bruteforce — 2026-07-15 07:03 evidence →
36.66.162.11 opportunistic_bruter 42% 40 2 ssh:bruteforce — 2026-07-15 11:57 evidence →
118.196.23.247 opportunistic_bruter 42% 60 2 ssh:bruteforce — 2026-07-15 02:22 evidence →
20.117.176.201 opportunistic_bruter 42% 30 2 ssh:bruteforce — 2026-07-15 13:31 evidence →
20.10.189.95 opportunistic_bruter 41% 24 2 ssh:bruteforce — 2026-07-15 16:18 evidence →
20.68.197.59 opportunistic_bruter 41% 40 2 ssh:bruteforce — 2026-07-15 04:05 evidence →
152.170.236.197 opportunistic_bruter 41% 40 2 ssh:bruteforce — 2026-07-14 23:55 evidence →
4.188.82.11 opportunistic_bruter 41% 30 2 ssh:bruteforce — 2026-07-15 04:41 evidence →
45.207.211.208 opportunistic_bruter 41% DROP 35 2 ssh:bruteforce — 2026-07-15 00:44 evidence →
20.90.90.83 opportunistic_bruter 41% 30 2 ssh:bruteforce — 2026-07-15 04:03 evidence →
59.92.102.69 opportunistic_bruter 41% 25 2 ssh:bruteforce — 2026-07-15 05:34 evidence →
172.174.211.162 opportunistic_bruter 41% 30 2 ssh:bruteforce — 2026-07-15 00:09 evidence →
20.169.161.126 opportunistic_bruter 40% 20 2 ssh:bruteforce — 2026-07-15 03:30 evidence →
59.8.179.193 opportunistic_bruter 40% 20 2 ssh:bruteforce — 2026-07-15 03:19 evidence →
20.90.145.127 opportunistic_bruter 40% 20 2 ssh:bruteforce — 2026-07-15 02:58 evidence →
20.200.136.38 opportunistic_bruter 40% 20 2 ssh:bruteforce — 2026-07-15 02:49 evidence →
218.13.43.88 opportunistic_bruter 40% 20 2 ssh:bruteforce — 2026-07-15 02:14 evidence →
135.232.97.58 opportunistic_bruter 40% 20 2 ssh:bruteforce — 2026-07-15 02:08 evidence →
13.82.138.89 opportunistic_bruter 40% 20 2 ssh:bruteforce — 2026-07-15 01:47 evidence →
20.198.217.25 opportunistic_bruter 40% 20 2 ssh:bruteforce — 2026-07-15 00:57 evidence →
52.187.126.101 opportunistic_bruter 40% 20 2 ssh:bruteforce — 2026-07-15 00:46 evidence →
221.200.246.20 opportunistic_bruter 40% 20 2 ssh:bruteforce — 2026-07-15 00:40 evidence →
40.124.97.202 opportunistic_bruter 40% 20 2 ssh:bruteforce — 2026-07-15 00:44 evidence →
102.223.8.232 opportunistic_bruter 40% 20 2 ssh:bruteforce — 2026-07-15 00:13 evidence →
167.86.175.100 opportunistic_bruter 40% 20 2 ssh:bruteforce — 2026-07-14 23:44 evidence →
171.80.15.232 opportunistic_bruter 40% 20 2 ssh:bruteforce — 2026-07-14 23:36 evidence →
104.36.252.166 scanner 32% 20 2 ssh:bruteforce — 2026-07-15 10:05 evidence →
222.186.57.88 scanner 31% 12 2 ssh:bruteforce — 2026-07-15 03:59 evidence →
47.52.147.70 scanner 30% 8 2 ssh:bruteforce — 2026-07-15 00:00 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds