IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
24 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
24 IPs
Below average
Total Events
28018
Below average by volume
Started / Ended
2026-02-25 06:02 — ongoing
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
123.58.213.128 credential_harvester 83% 1x OSINT 2285 3 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-18 20:43 evidence →
129.121.123.80 credential_harvester 83% 1x OSINT 1511 3 ssh:bruteforcessh:connectionssh:malware 129-121-123-80.unifiedlayer.com 2026-10-18 16:20 evidence →
103.172.28.62 credential_harvester 80% 1x OSINT 302 3 ssh:bruteforcessh:connectionssh:malware — 2026-10-18 05:58 evidence →
103.241.43.193 credential_harvester 76% 1x OSINT 2442 3 ssh:bruteforcessh:connectionssh:intrusionssh:malware hoangmin1-35045-40151.tino 2026-10-14 16:53 evidence →
151.252.84.225 credential_harvester 75% 1x OSINT 986 3 ssh:bruteforcessh:connectionssh:intrusionssh:malware 151.252.84.225.ip.tele-plus.ru 2026-10-14 11:22 evidence →
152.32.254.89 credential_harvester 71% 1x OSINT 2327 3 ssh:bruteforcessh:connectionssh:malware — 2026-10-01 00:11 evidence →
165.154.147.69 credential_harvester 71% 1x OSINT 1595 3 ssh:bruteforcessh:connectionssh:malware — 2026-10-06 23:48 evidence →
121.162.14.55 scanner 71% 100 3 telnet:connectiontelnet:intrusion — 2026-10-18 02:10 evidence →
111.48.160.201 scanner 68% 1x OSINT 188 3 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-09 11:28 evidence →
117.33.238.13 scanner 68% 1x OSINT 128 3 ssh:bruteforcessh:connectionssh:malware — 2026-09-30 06:30 evidence →
14.54.150.140 interactive_operator 65% 249 4 telnet:connectiontelnet:intrusiontelnet:malware — 2026-10-12 19:40 evidence →
109.160.32.114 credential_harvester 65% DROP2x OSINT 39570 4 ssh:bruteforcessh:connectionssh:intrusion — 2026-10-10 12:51 evidence →
154.198.162.234 credential_harvester 65% DROP 344 3 ssh:bruteforcessh:malware — 2026-09-30 23:44 evidence →
109.160.32.143 credential_harvester 61% DROP1x OSINT 2806 3 ssh:bruteforcessh:connectionssh:intrusion — 2026-10-05 01:10 evidence →
104.248.160.169 credential_harvester 56% 1x OSINT 827 2 ssh:bruteforcessh:malware — 2026-10-02 18:19 evidence →
64.89.163.165 mysql_bruter 56% DROP 402 4 mysql:bruteforce — 2026-10-18 06:13 evidence →
129.121.119.196 credential_harvester 52% 1476 2 ssh:bruteforcessh:connectionssh:malware localmistry.com 2026-10-10 07:04 evidence →
157.230.59.111 credential_harvester 49% 290 2 ssh:bruteforcessh:malware — 2026-10-04 00:52 evidence →
60.188.249.64 scanner 47% 1x OSINT 137 3 ssh:connection — 2026-10-11 00:06 evidence →
109.63.137.46 credential_harvester 46% 158 2 ssh:bruteforcessh:connectionssh:intrusion — 2026-09-30 21:53 evidence →
148.204.4.136 scanner 37% 8 3 telnet:connection pc-136.dcyc.ipn.mx 2026-10-11 07:32 evidence →
147.185.132.105 scanner 10% 1x OSINT 40 3 ssh:connectiontelnet:connection — 2026-10-07 04:09 evidence →
147.185.132.63 scanner 10% 28 3 http:scanssh:connectiontelnet:connection — 2026-10-12 00:13 evidence →
147.185.132.42 scanner 10% 1x OSINT 18 3 http:scanssh:connectiontelnet:connection — 2026-10-01 16:33 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds