AS401626 — CONTABO

Attacker network profile

Observed by OffSeq honeypot sensors · last 7 days · last seen 2026-08-31

1,646

Attacks

Distinct hosts (/16-masked)

OffSeq honeypot sensors recorded 1,646 attacks from 55 distinct hosts within AS401626in the last 7 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.

Techniques

T1110 Brute Force954
T1190 Exploit Public-Facing Application538
T1595.002 Vulnerability Scanning6
T1498.002 Reflection Amplification6
T1046 Network Service Discovery6
T1105 Ingress Tool Transfer5
T1595 Active Scanning3
T1552.001 Credentials In Files1

Services attacked

MySQL888
MongoDB584
PostgreSQL139
HTTP12
NTP6
TFTP5
SNMP4

Top countries

Poland18
Germany1

Sample request paths

/.env 185.65.x.x:7227 /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php / 185.65.x.x:7227

Open the live view →