IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
27 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
27 IPs
Below average
Total Events
124554
Average by volume
Started / Ended
2026-04-15 14:54 — ongoing
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
115.178.75.243 credential_harvester 84% 1x OSINT 4631 3 ssh:bruteforcessh:connectionssh:malware — 2026-10-20 16:12 evidence →
45.90.163.37 interactive_operator 84% 530 3 http:scanssh:connectionssh:intrusiontelnet:connectiontelnet:intrusion — 2026-10-20 20:47 evidence →
103.248.120.6 credential_harvester 83% 1x OSINT 3225 4 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-20 09:41 evidence →
103.69.96.120 credential_harvester 83% 1x OSINT 2886 4 ssh:bruteforcessh:connectionssh:malware — 2026-10-20 09:36 evidence →
106.243.155.71 credential_harvester 83% 1x OSINT 1619 4 ssh:bruteforcessh:connectionssh:malware — 2026-10-20 04:22 evidence →
113.254.77.18 scanner 77% 313 4 telnet:connectiontelnet:intrusiontelnet:malware 18-77-254-113-on-nets.com 2026-10-20 21:55 evidence →
109.160.32.108 credential_harvester 77% DROP2x OSINT 31718 4 ssh:bruteforcessh:connectionssh:intrusion — 2026-10-20 15:04 evidence →
109.160.32.151 credential_harvester 76% DROP2x OSINT 28330 4 ssh:bruteforcessh:connectionssh:intrusion — 2026-10-20 02:41 evidence →
211.194.41.69 scanner 74% 212 4 telnet:connectiontelnet:intrusion — 2026-10-20 20:59 evidence →
109.160.32.157 credential_harvester 74% DROP1x OSINT 29486 3 ssh:bruteforcessh:connectionssh:intrusion — 2026-10-20 20:57 evidence →
118.35.190.116 scanner 74% 192 4 telnet:connectiontelnet:intrusion — 2026-10-20 22:16 evidence →
104.157.47.144 scanner 74% 178 4 telnet:connectiontelnet:intrusion d-104-157-47-144.ab.hsia.telus.net 2026-10-20 23:24 evidence →
190.171.189.85 credential_harvester 74% 2x OSINT 73 2 ssh:bruteforcessh:intrusiontelnet:bruteforcetelnet:intrusion 190-171-189-85.empresas.movistar.cl 2026-10-20 20:43 evidence →
112.163.169.164 scanner 73% 174 4 telnet:connectiontelnet:intrusion — 2026-10-20 14:03 evidence →
119.192.214.148 scanner 71% 78 4 telnet:connectiontelnet:intrusion — 2026-10-19 21:14 evidence →
222.112.46.78 scanner 70% 22 4 telnet:connectiontelnet:intrusion — 2026-10-20 20:36 evidence →
109.160.32.153 credential_harvester 62% DROP2x OSINT 18004 2 ssh:bruteforcessh:connectionssh:intrusion — 2026-10-20 09:26 evidence →
103.66.149.152 scanner 59% 1x OSINT 175 3 telnet:connection 66-149-152.nasstecairnet.net.pk 2026-10-20 15:01 evidence →
103.66.149.153 scanner 59% 1x OSINT 353 4 telnet:connection 66-149-153.nasstecairnet.net.pk 2026-10-19 22:53 evidence →
118.172.34.84 malware_dropper 59% 96 2 telnet:connectiontelnet:intrusiontelnet:malware node-6s4.pool-118-172.dynamic.nt-isp.net 2026-10-20 08:10 evidence →
114.33.143.118 scanner 57% 62 2 telnet:connectiontelnet:intrusion 114-33-143-118.hinet-ip.hinet.net 2026-10-20 20:41 evidence →
104.199.36.53 web_probe 55% 1x OSINT 4 3 http:scan 53.36.199.104.bc.googleusercontent.com 2026-10-20 01:38 evidence →
45.115.26.32 reconnaissance 54% DROP 2306 2 ssh:bruteforcessh:connectionssh:intrusion — 2026-10-20 20:43 evidence →
101.33.66.34 web_probe 54% 32 4 http:scan — 2026-10-20 11:56 evidence →
77.90.185.14 scanner 50% DROP 8 4 ssh:connection — 2026-10-20 22:42 evidence →
131.186.5.113 web_probe 44% 4 2 http:scanssh:connection — 2026-10-20 20:46 evidence →
104.251.180.112 web_probe 39% DROP1x OSINT 2 2 http:scan — 2026-10-20 02:06 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds