Attack traffic from Hong Kong
Honeypot telemetry for sources geolocated to Hong Kong
Observed by OffSeq honeypot sensors · last 30 days · last seen 10 minutes ago · first observed 2026-09-25 (29 days ago)
75,505
Attacks
703
Distinct source IPs
6
KEV exploit hits
Attack traffic is led by TENCENT-NET-AP-CN Tencent Building.
OffSeq honeypot sensors recorded 75,505 attacks from 703 distinct hosts geolocated to Hong Kongin the last 30 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.
Techniques
- T1110 Brute Force27,395
- T1190 Exploit Public-Facing Application15,902
- T1021.005 VNC13,640
- T1595 Active Scanning6,778
- T1595.002 Vulnerability Scanning528
- T1046 Network Service Discovery473
- T1059 Command and Scripting Interpreter293
- T1657 Financial Theft224
- T1498.002 Reflection Amplification73
- T1210 Exploitation of Remote Services58
- T1505.003 Web Shell55
- T1071.003 Mail Protocols54
Top networks (ASNs)
- TENCENT-NET-AP-CN Tencent Building16,326
- ALIBABA-CN-NET Alibaba US Technology Co.11,477
- HOSTROYALE6,416
- GREENFLOID-AS5,908
- Microsoft Corporation5,103
- XSERVERCLOUD4,393
- UCLOUD-HK-AS-AP UCLOUD INFORMATION4,180
- CNSERVERS3,766
- HUTCHISON-AS-AP HGC Global2,677
- MAJESTIC-HOSTING-012,503
- TELE-AS Tele Asia Limited2,288
- HKBN-AS-AP HK Broadband Network Ltd.1,957