IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
21 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Azure. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
Azure
Member Count
21 IPs
Below average
Total Events
26478
Below average by volume
Started / Ended
2026-10-16 09:16 — ongoing
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
103.98.176.164 credential_harvester 84% 1x OSINT 4125 4 ssh:bruteforcessh:connectionssh:malware — 2026-10-24 11:18 evidence →
113.193.234.210 credential_harvester 84% 1x OSINT 1528 3 ssh:bruteforcessh:connectionssh:malware — 2026-10-24 10:19 evidence →
147.50.227.79 credential_harvester 84% 1x OSINT 3500 4 ssh:bruteforcessh:connectionssh:malware — 2026-10-24 06:42 evidence →
103.89.136.111 credential_harvester 84% 1x OSINT 1009 3 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-24 06:25 evidence →
103.20.122.54 credential_harvester 83% 1x OSINT 3889 4 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-24 04:59 evidence →
125.16.27.190 credential_harvester 83% 1x OSINT 1713 3 ssh:bruteforcessh:connectionssh:malware — 2026-10-24 02:44 evidence →
104.244.74.84 credential_harvester 83% 1x OSINT 3353 4 ssh:bruteforcessh:connectionssh:malware — 2026-10-23 20:00 evidence →
124.155.125.131 credential_harvester 82% 1x OSINT 2849 4 ssh:bruteforcessh:connectionssh:malware v125131.ppp.asahi-net.or.jp 2026-10-23 13:46 evidence →
114.220.238.224 scanner 80% 1x OSINT 214 3 ssh:bruteforcessh:connectionssh:malware — 2026-10-23 16:26 evidence →
14.103.118.106 scanner 80% 1x OSINT 124 3 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-24 02:24 evidence →
119.93.221.255 interactive_operator 74% 438 3 telnet:connectiontelnet:intrusion — 2026-10-23 16:37 evidence →
129.121.142.174 opportunistic_bruter 67% 1x OSINT 465 2 ssh:bruteforcessh:malware 129-121-142-174.unifiedlayer.com 2026-10-24 06:24 evidence →
152.32.229.251 opportunistic_bruter 64% 1x OSINT 92 2 ssh:bruteforcessh:malware — 2026-10-24 04:34 evidence →
43.130.14.239 opportunistic_bruter 64% 1x OSINT 46 2 ssh:bruteforcessh:malware — 2026-10-24 12:16 evidence →
116.118.6.157 opportunistic_bruter 62% 1x OSINT 46 2 ssh:bruteforcessh:malware — 2026-10-23 18:58 evidence →
118.145.148.31 scanner 62% 1x OSINT 37 2 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-23 23:06 evidence →
20.211.97.120 web_probe 60% 1x OSINT 37 3 http:scan — 2026-10-24 13:33 evidence →
14.63.166.251 scanner 57% 2927 2 ssh:connection — 2026-10-24 03:39 evidence →
100.2.219.251 scanner 53% 16 2 telnet:connectiontelnet:intrusion pool-100-2-219-251.nycmny.fios.verizon.net 2026-10-23 12:56 evidence →
112.163.135.25 scanner 52% 46 3 telnet:connection — 2026-10-23 23:50 evidence →
101.66.165.103 scanner 40% 1x OSINT 30 2 ssh:connection — 2026-10-23 15:15 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds