Attack traffic from China
Honeypot telemetry for sources geolocated to China
Observed by OffSeq honeypot sensors · last 30 days · last seen 15 minutes ago · first observed 2026-09-25 (29 days ago)
676,521
Attacks
3,815
Distinct source IPs
11
KEV exploit hits
Attack traffic is led by TENCENT-NET-AP Shenzhen Tencent.
OffSeq honeypot sensors recorded 676,521 attacks from 3,815 distinct hosts geolocated to Chinain the last 30 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.
Techniques
- T1110 Brute Force336,103
- T1021.005 VNC214,131
- T1190 Exploit Public-Facing Application11,763
- T1046 Network Service Discovery2,466
- T1595 Active Scanning2,113
- T1210 Exploitation of Remote Services1,643
- T1187 Forced Authentication1,383
- T1059 Command and Scripting Interpreter1,200
- T1595.002 Vulnerability Scanning574
- T1657 Financial Theft112
- T1078 Valid Accounts88
- T1552 Unsecured Credentials81
Top networks (ASNs)
- TENCENT-NET-AP Shenzhen Tencent179,059
- ALIBABA-CN-NET Hangzhou Alibaba135,674
- CHINANET-BACKBONE129,234
- CHINA169-BACKBONE CHINA UNICOM China16961,239
- CHINANET-SH-AP China Telecom Group18,556
- CMNET-V4HEBEI-AS-AP Hebei Mobile18,422
- CHINAMOBILE-CN China Mobile16,930
- VOLCANO-ENGINE Beijing Volcano Engine9,130
- SDYXT Shandong eshinton Network6,784
- CMNET-JIANGXI-AP China Mobile6,316
- CHINATELECOM-JIANGSU-SUZHOU-5G-NETWORK6,092