← Back to feed

Multi-Agent Scan

SCAN Active medium

Why this campaign was detected

11 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.

Primary ASN

—

Subnet

—

Country

—

Cloud Provider

—

Member Count

11 IPs

Below average

Total Events

63471

Average by volume

Started / Ended

2026-03-01 15:09 — ongoing

Member Actors

IP Address	Behavior	Confidence	Flags	Events	Agents	Attack Types	Hostname	Last Seen
130.12.180.51	data_exfiltrator	84%	DROP1x OSINT	11358	4	ssh:bruteforcessh:connectionssh:intrusionssh:malware	—	2026-10-19 15:22	evidence →
109.160.32.109	credential_harvester	78%	DROP2x OSINT	39863	4	ssh:bruteforcessh:connectionssh:intrusion	—	2026-10-19 16:32	evidence →
109.160.32.140	credential_harvester	76%	DROP2x OSINT	15884	3	ssh:bruteforcessh:connectionssh:intrusion	—	2026-10-18 23:36	evidence →
121.188.17.252	scanner	73%		104	3	telnet:connectiontelnet:intrusion	—	2026-10-19 14:27	evidence →
66.240.236.109	scanner	66%	1x OSINT	67	4	ssh:connectiontelnet:connection	pdcscan2.scanning.cybcube.com	2026-10-19 15:11	evidence →
119.204.110.221	interactive_operator	64%		876	2	telnet:connectiontelnet:credential-reusetelnet:intrusiontelnet:malware	—	2026-10-19 18:14	evidence →
130.12.180.174	scanner	63%	DROP1x OSINT	1560	4	telnet:connection	—	2026-10-19 21:00	evidence →
129.121.101.179	opportunistic_bruter	62%	1x OSINT	46	2	ssh:bruteforcessh:malware	129-121-101-179.unifiedlayer.com	2026-10-18 17:34	evidence →
79.135.225.50	scanner	56%		52	2	telnet:connectiontelnet:intrusion	—	2026-10-19 15:03	evidence →
112.118.192.92	interactive_operator	55%		50	2	telnet:connectiontelnet:intrusion	n112118192092.netvigator.com	2026-10-19 00:31	evidence →
43.159.149.216	web_probe	54%		26	4	http:scan	—	2026-10-19 15:16	evidence →

VPN Known VPN or proxy provider

DROP ASN on Spamhaus DROP list

Nx OSINT Corroborated by N external threat feeds