Attack traffic from Iraq

Honeypot telemetry for sources geolocated to Iraq

Observed by OffSeq honeypot sensors · last 30 days · last seen 6 hours ago · first observed 2026-09-25 (29 days ago)

340

Attacks

Distinct source IPs

Attack traffic is led by GCS-AS.

OffSeq honeypot sensors recorded 340 attacks from 98 distinct hosts geolocated to Iraqin the last 30 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.

Techniques

T1190 Exploit Public-Facing Application150
T1110 Brute Force112
T1595 Active Scanning22
T1552 Unsecured Credentials11
T1059 Command and Scripting Interpreter11
T1087 Account Discovery9
T1071.003 Mail Protocols9
T1210 Exploitation of Remote Services7

Top networks (ASNs)

GCS-AS111
EARTHLINK-DMCC-IQ90
RICAWEBSERVICES5

Open the live view → Get this in real time →