AS11878 — TZULO
Attacker network profile
Observed by OffSeq honeypot sensors · last 30 days · last seen 2 minutes ago · first observed 2026-09-25 (29 days ago)
420,828
Attacks
3,723
Distinct source IPs
6
KEV exploit hits
Attacks from this network most often target T1190 Exploit Public-Facing Application.
OffSeq honeypot sensors recorded 420,828 attacks from 3,723 distinct hosts within AS11878in the last 30 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.
Techniques
- T1190 Exploit Public-Facing Application241,706
- T1110 Brute Force141,058
- T1021.005 VNC10,526
- T1595 Active Scanning4,495
- T1552 Unsecured Credentials507
- T1592 Gather Victim Host Information326
- T1657 Financial Theft159
- T1071.003 Mail Protocols12
- T1552.001 Credentials In Files2
- T1498.002 Reflection Amplification2
- T1059 Command and Scripting Interpreter1
Top countries
- United States420,826
- Canada2