Attack traffic from Brazil

Honeypot telemetry for sources geolocated to Brazil

Observed by OffSeq honeypot sensors · last 7 days · last seen just now · first observed 2026-10-04 (7 days ago)

231,176

Attacks

1,811

Distinct source IPs

KEV exploit hits

Attack traffic is led by CLOUVIDER Clouvider - Global ASN.

OffSeq honeypot sensors recorded 231,176 attacks from 1,811 distinct hosts geolocated to Brazilin the last 7 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.

Techniques

T1110 Brute Force138,294
T1657 Financial Theft38,413
T1190 Exploit Public-Facing Application33,606
T1021.005 VNC7,028
T1595 Active Scanning486
T1552 Unsecured Credentials231
T1595.002 Vulnerability Scanning177
T1210 Exploitation of Remote Services71

Services attacked

VNC92,356
HTTPS53,962
SIP38,648
Microsoft SQL Server23,111
SMB21,439
HTTP1,342
RDP99
Telnet59

Top networks (ASNs)

CLOUVIDER Clouvider - Global ASN48,061
CHERRYSERVERS3-AS38,395
BATTLEHOST BattleHost27,913
Terracel Provedor de Internet Ltda Me19,103
ALGAR TELECOM SA13,023
UNIFIQUE TELECOMUNICACOES SA10,802
PROVEDOR DE INTERNET SANTI LTDA - ME5,489
SERVER-MANIA2,213

Sample request paths

/remote/logincheck /vpn/index.html /remote/login /p/u/getAuthenticationRequirements.do /logon/LogonPoint/index.html

Open the live view →