Attack traffic from Denmark
Honeypot telemetry for sources geolocated to Denmark
Observed by OffSeq honeypot sensors · last 30 days · last seen 1 hour ago · first observed 2026-09-25 (29 days ago)
8,039
Attacks
74
Distinct source IPs
Attack traffic is led by CDNEXT.
OffSeq honeypot sensors recorded 8,039 attacks from 74 distinct hosts geolocated to Denmarkin the last 30 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.
Techniques
- T1110 Brute Force4,938
- T1190 Exploit Public-Facing Application767
- T1552.001 Credentials In Files127
- T1595 Active Scanning59
- T1059 Command and Scripting Interpreter51
- T1046 Network Service Discovery20
- T0846 Remote System Discovery15
- T1595.002 Vulnerability Scanning6
- T1552 Unsecured Credentials2
- T1210 Exploitation of Remote Services2
- T1021.005 VNC1
Top networks (ASNs)
- CDNEXT6,785
- WEBNX750
- DOTSRC144
- TDC TDC AS81
- HI3G75
- ZENCURITY-NET50
- NETCUP-AS netcup GmbH36
- Microsoft Corporation10