Attack traffic from Brazil

Honeypot telemetry for sources geolocated to Brazil

Observed by OffSeq honeypot sensors · last 7 days · last seen just now · first observed 2026-10-15 (7 days ago)

120,406

Attacks

893

Distinct source IPs

Attack traffic is led by CLOUVIDER Clouvider - Global ASN.

OffSeq honeypot sensors recorded 120,406 attacks from 893 distinct hosts geolocated to Brazilin the last 7 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.

Techniques

T1110 Brute Force56,786
T1190 Exploit Public-Facing Application33,145
T1021.005 VNC9,878
T1059 Command and Scripting Interpreter2,363
T1595 Active Scanning1,260
T1657 Financial Theft1,244
T1552 Unsecured Credentials491
T1595.002 Vulnerability Scanning403

Services attacked

HTTPS53,024
VNC38,353
Microsoft SQL Server16,664
SMB3,450
HTTP2,861
Telnet2,483
SIP1,793
RDP1,024

Top networks (ASNs)

CLOUVIDER Clouvider - Global ASN52,013
BATTLEHOST BattleHost23,300
ALGAR TELECOM SA5,999
ALGAR TELECOM SA5,747
PROVEDOR DE INTERNET SANTI LTDA - ME5,434
PIX TELECOM PROVEDOR DE INTERNET LTDA4,654
ORACLE-BMC-318983,663
ZHOUYISAT-COMMUNICATIONS2,419

Sample request paths

/remote/logincheck /vpn/index.html / /hachk.php /p/u/getAuthenticationRequirements.do

Open the live view →