Attack traffic from Bulgaria
Honeypot telemetry for sources geolocated to Bulgaria
Observed by OffSeq honeypot sensors · last 30 days · last seen 4 minutes ago · first observed 2026-09-25 (29 days ago)
166,918
Attacks
395
Distinct source IPs
2
KEV exploit hits
Attack traffic is led by TAMATIYA-AS.
OffSeq honeypot sensors recorded 166,918 attacks from 395 distinct hosts geolocated to Bulgariain the last 30 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.
Techniques
- T1110 Brute Force116,663
- T1021.005 VNC12,926
- T1190 Exploit Public-Facing Application9,563
- T1046 Network Service Discovery2,808
- T1059 Command and Scripting Interpreter2,780
- T1595.002 Vulnerability Scanning1,752
- T1595 Active Scanning1,571
- T1071.003 Mail Protocols273
- T0846 Remote System Discovery215
- T1498.002 Reflection Amplification148
- T1040 Network Sniffing142
- T1552.001 Credentials In Files96
Top networks (ASNs)
- TAMATIYA-AS59,180
- TECHTIES-AS - TechTies Inc.25,461
- OMEGATECH-AS23,791
- HOMELINE-AS9,834
- MODAT-018,532
- TECHOFF SRV LIMITED2,058
- MEVSPACE1,530
- BLISS1,509
- IS-AS-11,413