IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
28 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
28 IPs
Below average
Total Events
67422
Average by volume
Started / Ended
2026-06-25 21:12 — ongoing
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
195.178.110.228 credential_harvester 88% DROP2x OSINT 45006 4 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-27 07:28 evidence →
114.111.53.214 credential_harvester 84% 1x OSINT 1676 4 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-27 00:20 evidence →
102.23.122.235 credential_harvester 83% 1x OSINT 1933 4 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-26 20:42 evidence →
166.62.41.13 credential_harvester 83% 1x OSINT 3766 4 ssh:bruteforcessh:connectionssh:intrusionssh:malware 13.41.62.166.host.secureserver.net 2026-10-26 20:06 evidence →
203.121.40.210 credential_harvester 83% 1x OSINT 1945 4 ssh:bruteforcessh:connectionssh:malware — 2026-10-26 18:47 evidence →
129.121.75.215 credential_harvester 83% 1x OSINT 1123 4 ssh:bruteforcessh:malware 129-121-75-215.unifiedlayer.com 2026-10-26 17:30 evidence →
115.178.75.242 credential_harvester 83% 1x OSINT 2741 4 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-26 14:57 evidence →
51.91.96.79 credential_harvester 83% 1x OSINT 1284 4 ssh:bruteforcessh:connectionssh:malware vps-456b3bcc.vps.ovh.net 2026-10-26 14:48 evidence →
103.216.145.2 credential_harvester 83% 1x OSINT 973 4 ssh:bruteforcessh:malware triocorporation.in 2026-10-26 14:43 evidence →
112.216.120.67 credential_harvester 83% 1x OSINT 1266 4 ssh:bruteforcessh:malware — 2026-10-26 13:46 evidence →
135.235.138.43 credential_harvester 83% 1x OSINT 3562 4 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-26 13:11 evidence →
115.79.192.73 credential_harvester 82% 1x OSINT 593 3 ssh:bruteforcessh:connectionssh:malware adsl.viettel.vn 2026-10-26 09:20 evidence →
113.161.79.218 credential_harvester 81% 1x OSINT 267 3 ssh:bruteforcessh:connectionssh:malware static.vnpt.vn 2026-10-27 00:35 evidence →
211.185.14.39 interactive_operator 75% 592 4 telnet:connectiontelnet:credential-reusetelnet:intrusion — 2026-10-26 16:27 evidence →
111.235.150.169 opportunistic_bruter 75% 69 3 ssh:bruteforcessh:malware — 2026-10-27 04:55 evidence →
119.192.187.103 scanner 71% 68 3 telnet:connectiontelnet:intrusion — 2026-10-26 19:24 evidence →
50.6.228.85 credential_harvester 66% 1x OSINT 300 2 ssh:bruteforcessh:malware 50-6-228-85.unifiedlayer.com 2026-10-26 15:30 evidence →
113.31.103.129 scanner 66% 1x OSINT 223 2 ssh:bruteforcessh:connectionssh:intrusionssh:malware knfcwki.cn 2026-10-26 16:23 evidence →
45.194.27.249 credential_harvester 65% 1x OSINT 102 2 ssh:bruteforcessh:malware — 2026-10-27 05:00 evidence →
103.233.66.227 malware_dropper 64% 1109 2 telnet:connectiontelnet:malware 103233static066227.asianet.co.in 2026-10-26 21:15 evidence →
102.206.251.94 scanner 63% 1155 2 telnet:connectiontelnet:malware — 2026-10-26 15:02 evidence →
38.110.46.235 web_probe 60% 6 3 http:scanssh:connection researchscan235.cc.gatech.edu 2026-10-27 04:44 evidence →
101.33.81.73 web_probe 55% 34 4 http:scan — 2026-10-27 03:36 evidence →
64.89.163.153 mysql_bruter 54% DROP 75 4 mysql:bruteforce — 2026-10-26 22:06 evidence →
49.51.183.75 web_probe 53% 19 4 http:scan — 2026-10-26 16:18 evidence →
168.107.21.149 opportunistic_bruter 48% 138 2 telnet:bruteforce — 2026-10-27 01:20 evidence →
4.148.119.146 scanner 46% 10 2 telnet:connectiontelnet:intrusion — 2026-10-27 04:46 evidence →
1.48.21.70 scanner 34% 4 2 telnet:connection — 2026-10-27 03:56 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds