Attack traffic from Spain
Honeypot telemetry for sources geolocated to Spain
Observed by OffSeq honeypot sensors · last 30 days · last seen 15 minutes ago · first observed 2026-09-25 (29 days ago)
25,794
Attacks
908
Distinct source IPs
Attack traffic is led by IONOS-AS This is the joint network for.
OffSeq honeypot sensors recorded 25,794 attacks from 908 distinct hosts geolocated to Spainin the last 30 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.
Techniques
- T1110 Brute Force12,932
- T1190 Exploit Public-Facing Application4,508
- T1021.005 VNC2,831
- T1595 Active Scanning1,922
- T1595.002 Vulnerability Scanning684
- T1657 Financial Theft481
- T1046 Network Service Discovery136
- T1071.003 Mail Protocols81
- T1552 Unsecured Credentials56
- T1498.002 Reflection Amplification55
- T1210 Exploitation of Remote Services23
- T1505.003 Web Shell15
Top networks (ASNs)
- IONOS-AS This is the joint network for10,766
- CDNEXT5,223
- AMARUTU-TECHNOLOGY1,711
- BUDUSCHEE1,647
- OVH1,500
- HOSTHATCH455
- TELEFONICA_DE_ESPANA398
- DIGISPAINTELECOM396
- UNI2-AS375
- SOLIDCORE330
- AXARNET COMUNICACIONES287
- XTRA Telecom284