Attack traffic from Iran
Honeypot telemetry for sources geolocated to Iran
Observed by OffSeq honeypot sensors · last 30 days · last seen 20 minutes ago · first observed 2026-09-25 (29 days ago)
505,171
Attacks
1,143
Distinct source IPs
Attack traffic is led by ESAB-AS.
OffSeq honeypot sensors recorded 505,171 attacks from 1,143 distinct hosts geolocated to Iranin the last 30 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.
Techniques
- T1110 Brute Force353,617
- T1657 Financial Theft52,603
- T1190 Exploit Public-Facing Application50,536
- T1021.005 VNC2,448
- T1595.002 Vulnerability Scanning1,383
- T1595 Active Scanning1,040
- T1046 Network Service Discovery986
- T1105 Ingress Tool Transfer851
- T1210 Exploitation of Remote Services448
- T1552.001 Credentials In Files319
- T1059 Command and Scripting Interpreter174
- T1071.003 Mail Protocols160
Top networks (ASNs)
- ESAB-AS84,578
- CDNEXT63,557
- COD44,466
- M24742,298
- PARVASYSTEM14,277
- IDNIC-IKADA-AS-ID PT Industri Kreatif12,779
- TCI12,552
- RASANA10,850
- KOI-AS5,153
- LIMITEDNETWORK-AS3,772
- DIGITALOCEAN-AS3934062,809