Attack traffic from Finland
Honeypot telemetry for sources geolocated to Finland
Observed by OffSeq honeypot sensors · last 30 days · last seen 9 minutes ago · first observed 2026-09-25 (29 days ago)
35,304
Attacks
221
Distinct source IPs
Attack traffic is led by CLOUVIDER Clouvider - Global ASN.
OffSeq honeypot sensors recorded 35,304 attacks from 221 distinct hosts geolocated to Finlandin the last 30 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.
Techniques
- T1190 Exploit Public-Facing Application12,950
- T1110 Brute Force9,801
- T1595 Active Scanning5,910
- T1021.005 VNC704
- T1552 Unsecured Credentials574
- T1595.002 Vulnerability Scanning35
- T1046 Network Service Discovery18
- T1505.003 Web Shell13
- T1059 Command and Scripting Interpreter5
- T1210 Exploitation of Remote Services4
- T1589.002 Email Addresses2
- T1592 Gather Victim Host Information2
Top networks (ASNs)
- CLOUVIDER Clouvider - Global ASN20,665
- HETZNER-AS11,878
- SOLDATOV-AS2,401
- AS-WAF92
- GOOGLE-CLOUD-PLATFORM68
- BLIX50
- ESTNOC-GLOBAL39
- American Information Network6
- AS5