AS396982 — GOOGLE-CLOUD-PLATFORM
Attacker network profile
Observed by OffSeq honeypot sensors · last 30 days · last seen 13 minutes ago · first observed 2026-08-15 (30 days ago)
107,462
Attacks
3,600
Distinct source IPs
27
KEV exploit hits
Attacks from this network most often target T1595 Active Scanning.
OffSeq honeypot sensors recorded 107,462 attacks from 3,600 distinct hosts within AS396982in the last 30 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.
Techniques
- T1595 Active Scanning37,608
- T1190 Exploit Public-Facing Application29,303
- T1110 Brute Force17,973
- T1552 Unsecured Credentials13,518
- T1046 Network Service Discovery2,325
- T1595.002 Vulnerability Scanning2,195
- T1498.002 Reflection Amplification1,136
- T1505.003 Web Shell453
- T1210 Exploitation of Remote Services368
- T1592 Gather Victim Host Information367
- T0846 T0846319
- T1552.001 Credentials In Files231
Top countries
- United States62,145
- Belgium18,919
- Singapore5,716
- The Netherlands3,398
- Taiwan3,350
- Japan3,076
- United Kingdom2,446
- Germany1,588
- Brazil1,277
- Italy1,028
- Switzerland914
- Spain849