IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
23 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
23 IPs
Below average
Total Events
23693
Below average by volume
Started / Ended
2026-09-25 15:50 — ongoing
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
103.82.21.8 credential_harvester 86% 2x OSINT 1153 4 ssh:bruteforcessh:malware — 2026-10-27 09:14 evidence →
103.248.120.6 credential_harvester 86% 2x OSINT 3598 4 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-27 06:22 evidence →
202.145.0.18 credential_harvester 84% 1x OSINT 2617 3 ssh:bruteforcessh:connectionssh:malware — 2026-10-28 01:47 evidence →
187.212.33.78 credential_harvester 84% 1x OSINT 1034 4 ssh:bruteforcessh:connectionssh:malware dsl-78-33-212-187-dynamic.prod-infinitum.com.mx 2026-10-28 01:29 evidence →
103.98.176.164 credential_harvester 84% 1x OSINT 4319 4 ssh:bruteforcessh:connectionssh:malware — 2026-10-27 20:34 evidence →
2.180.32.104 credential_harvester 83% 1x OSINT 760 4 ssh:bruteforcessh:connectionssh:malware — 2026-10-28 01:23 evidence →
104.248.160.169 credential_harvester 83% 1x OSINT 944 4 ssh:bruteforcessh:malware — 2026-10-27 13:28 evidence →
103.70.40.36 credential_harvester 82% 1x OSINT 6994 3 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-27 02:47 evidence →
121.139.211.160 scanner 82% 1x OSINT 359 4 telnet:connectiontelnet:intrusiontelnet:malware — 2026-10-28 01:13 evidence →
202.165.14.135 opportunistic_bruter 81% 1x OSINT 240 3 ssh:bruteforcessh:malware — 2026-10-28 01:42 evidence →
103.53.158.121 credential_harvester 65% 1x OSINT 266 2 ssh:bruteforcessh:connectionssh:malware — 2026-10-27 09:52 evidence →
50.6.195.83 opportunistic_bruter 64% 1x OSINT 46 2 ssh:bruteforcessh:malware 50-6-195-83.unifiedlayer.com 2026-10-28 01:27 evidence →
182.69.178.174 opportunistic_bruter 64% 1x OSINT 46 2 ssh:bruteforcessh:malware abts-north-dynamic-174.178.69.182.airtelbroadband.in 2026-10-28 01:29 evidence →
119.204.49.2 scanner 63% 1151 2 telnet:connectiontelnet:malware — 2026-10-27 13:14 evidence →
103.29.70.204 scanner 60% 2x OSINT 32 4 ssh:connection linode.scan.security.ipip.net 2026-10-28 02:13 evidence →
103.203.57.11 scanner 56% 294 4 ssh:connection scan-57-11.security.ipip.net 2026-10-28 03:41 evidence →
103.203.57.19 scanner 52% 58 4 telnet:connection scan-57-19.security.ipip.net 2026-10-27 12:20 evidence →
185.219.128.11 scanner 43% 10 2 ssh:connectiontelnet:connection — 2026-10-28 01:25 evidence →
104.155.55.151 scanner 39% 70 2 telnet:bruteforcetelnet:connection 151.55.155.104.bc.googleusercontent.com 2026-10-27 05:18 evidence →
2.58.56.23 web_probe 39% DROP 20 2 http:scan 2-58-56-23.powered.by.rdp.vision 2026-10-28 01:21 evidence →
103.195.237.209 scanner 38% 120 2 ssh:connection — 2026-10-27 09:37 evidence →
95.133.167.106 scanner 35% 10 2 ssh:connection — 2026-10-28 01:22 evidence →
103.157.221.51 scanner 33% 4 2 telnet:connection — 2026-10-27 17:52 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds