IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
28 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
28 IPs
Below average
Total Events
36667
Average by volume
Started / Ended
2026-10-23 16:01 — ongoing
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
72.253.251.3 credential_harvester 88% 2x OSINT 3359 4 ssh:bruteforcessh:connectionssh:malware — 2026-10-27 09:21 evidence →
103.248.120.6 credential_harvester 87% 2x OSINT 3598 4 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-27 06:22 evidence →
212.154.234.9 credential_harvester 84% 1x OSINT 3707 3 ssh:bruteforcessh:connectionssh:malware — 2026-10-27 09:28 evidence →
46.253.45.10 credential_harvester 84% 1x OSINT 3018 4 ssh:bruteforcessh:connectionssh:malware 46-253-45-10.anxanet.com 2026-10-27 09:20 evidence →
103.117.145.130 credential_harvester 84% 1x OSINT 1082 4 ssh:bruteforcessh:connectionssh:malware blockonetech.com.sg 2026-10-27 06:13 evidence →
103.70.40.36 credential_harvester 84% 1x OSINT 6994 3 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-27 02:47 evidence →
103.165.227.178 credential_harvester 83% 1x OSINT 1038 4 ssh:bruteforcessh:connectionssh:intrusionssh:malware 178.227.165.103.net.iforte.net.id 2026-10-26 20:57 evidence →
102.23.122.235 credential_harvester 83% 1x OSINT 1933 4 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-26 20:42 evidence →
185.143.197.45 credential_harvester 83% 1x OSINT 402 3 ssh:bruteforcessh:malware — 2026-10-27 09:13 evidence →
43.129.193.109 credential_harvester 82% 1x OSINT 333 3 ssh:bruteforcessh:malware — 2026-10-27 09:28 evidence →
196.0.3.188 credential_harvester 82% 1x OSINT 234 4 ssh:bruteforcessh:intrusionssh:malware graylog.utclonline.co.ug 2026-10-27 09:16 evidence →
103.95.40.58 credential_harvester 81% 1x OSINT 318 3 ssh:bruteforcessh:malware ip-58.40.hsp.net.id 2026-10-26 16:51 evidence →
116.118.6.157 opportunistic_bruter 79% 1x OSINT 69 3 ssh:bruteforcessh:malware — 2026-10-27 09:20 evidence →
129.121.117.162 opportunistic_bruter 79% 1x OSINT 48 3 ssh:bruteforcessh:connectionssh:malware 129-121-117-162.unifiedlayer.com 2026-10-27 09:12 evidence →
103.159.2.113 credential_harvester 77% 2x OSINT 6509 4 ssh:bruteforcessh:connectionssh:intrusion — 2026-10-27 06:22 evidence →
103.53.158.121 credential_harvester 67% 1x OSINT 266 2 ssh:bruteforcessh:connectionssh:malware — 2026-10-27 09:52 evidence →
177.10.198.179 scanner 64% 1149 2 telnet:connectiontelnet:malware — 2026-10-27 09:17 evidence →
103.233.66.227 malware_dropper 63% 1109 2 telnet:connectiontelnet:malware 103233static066227.asianet.co.in 2026-10-26 21:15 evidence →
102.206.251.94 scanner 63% 1155 2 telnet:connectiontelnet:malware — 2026-10-26 15:02 evidence →
103.38.237.19 opportunistic_bruter 62% 1x OSINT 46 2 ssh:bruteforcessh:malware — 2026-10-26 11:35 evidence →
103.152.101.118 scanner 58% 1x OSINT 146 3 telnet:connection 103.152.101.118-hn.com.pk 2026-10-26 10:49 evidence →
103.29.70.204 scanner 56% 1x OSINT 28 4 ssh:connection linode.scan.security.ipip.net 2026-10-27 04:09 evidence →
104.30.167.164 web_probe 54% 49 3 http:scan — 2026-10-26 21:28 evidence →
101.33.81.73 web_probe 54% 34 4 http:scan — 2026-10-27 03:36 evidence →
43.166.239.145 web_probe 54% 23 4 http:scan — 2026-10-27 09:15 evidence →
103.195.237.209 scanner 39% 120 2 ssh:connection — 2026-10-27 09:37 evidence →
1.48.21.70 scanner 33% 4 2 telnet:connection — 2026-10-27 03:56 evidence →
103.22.140.130 scanner 33% 4 2 telnet:connection — 2026-10-26 23:28 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds