Attack traffic from Bulgaria

Honeypot telemetry for sources geolocated to Bulgaria

Observed by OffSeq honeypot sensors · last 7 days · last seen 2026-08-31

46,925

Attacks

152

Distinct hosts (/16-masked)

KEV exploit hits

OffSeq honeypot sensors recorded 46,925 attacks from 152 distinct hosts geolocated to Bulgariain the last 7 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.

CVEs targeted

CVE-2022-406846
CVE-2019-07083
CVE-2018-133793

Techniques

T1110 Brute Force39,327
T1190 Exploit Public-Facing Application2,066
T1021.005 VNC1,497
T1595.002 Vulnerability Scanning842
T1552.001 Credentials In Files197
T1595 Active Scanning135
T1059 Command and Scripting Interpreter130
T1046 Network Service Discovery125

Services attacked

SIP20,628
VNC10,551
SMTP8,984
HTTP1,765
RDP1,253
HTTPS1,013
SSH854
PostgreSQL704

Top networks (ASNs)

TECHTIES-AS - TechTies Inc.20,398
OMEGATECH-AS8,804
TAMATIYA-AS4,914
MAZEN2,682
AS-BG-BAS2,053
MODAT-011,227
MASSIVEGRID697
DMZHOST565

Sample request paths

/ /login /remote/login /vpn/index.html /.env

Open the live view →