Attack traffic from India
Honeypot telemetry for sources geolocated to India
Observed by OffSeq honeypot sensors · last 30 days · last seen 11 minutes ago · first observed 2026-09-25 (29 days ago)
426,888
Attacks
1,521
Distinct source IPs
115
KEV exploit hits
Attack traffic is led by INPL-IN-AP Ishans Network.
OffSeq honeypot sensors recorded 426,888 attacks from 1,521 distinct hosts geolocated to Indiain the last 30 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.
Techniques
- T1110 Brute Force345,599
- T1021.005 VNC29,636
- T1595 Active Scanning16,180
- T1190 Exploit Public-Facing Application5,368
- T1059 Command and Scripting Interpreter2,615
- T1595.002 Vulnerability Scanning1,323
- T1210 Exploitation of Remote Services937
- T1552 Unsecured Credentials639
- T1187 Forced Authentication312
- T1046 Network Service Discovery257
- T1505.003 Web Shell170
- T1505 Server Software Component146