Attack traffic from China

Honeypot telemetry for sources geolocated to China

Observed by OffSeq honeypot sensors · last 7 days · last seen 2026-09-01

192,707

Attacks

1,433

Distinct hosts (/16-masked)

OffSeq honeypot sensors recorded 192,707 attacks from 1,433 distinct hosts geolocated to Chinain the last 7 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.

Techniques

T1021.005 VNC87,808
T1110 Brute Force66,591
T1190 Exploit Public-Facing Application3,245
T1595 Active Scanning866
T1046 Network Service Discovery816
T1595.002 Vulnerability Scanning279
T1210 Exploitation of Remote Services179
T1059 Command and Scripting Interpreter52

Services attacked

VNC118,854
Microsoft SQL Server51,064
SMTP8,943
SMB6,784
Redis2,254
HTTP1,539
RDP529

Top networks (ASNs)

TENCENT-NET-AP Shenzhen Tencent Computer Systems49,006
ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,24,850
CHINANET-BACKBONE No.31,Jin-rong Street12,921
CHINAMOBILE-CN China Mobile Communications Group11,462
CHINA169-BACKBONE CHINA UNICOM China169 Backbone11,460
CMNET-JIANGSU-AP China Mobile communications cor4,100
HANMING-AS4,084
CMNET-ZHEJIANG-AP China Mobile communications co3,606

Sample request paths

/ /wp-login.php /favicon.ico /v1/models /vpn/index.html

Open the live view →