Attack traffic from Iran

Honeypot telemetry for sources geolocated to Iran

Observed by OffSeq honeypot sensors · last 7 days · last seen 2026-08-31

79,718

Attacks

206

Distinct hosts (/16-masked)

OffSeq honeypot sensors recorded 79,718 attacks from 206 distinct hosts geolocated to Iranin the last 7 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.

Techniques

T1110 Brute Force72,157
T1190 Exploit Public-Facing Application1,509
T1595 Active Scanning920
T1595.002 Vulnerability Scanning308
T1046 Network Service Discovery302
T1059 Command and Scripting Interpreter104
T1210 Exploitation of Remote Services73
T1498.002 Reflection Amplification69

Services attacked

SMTP70,635
Microsoft SQL Server3,439
HTTP1,282
SSH926
SMB438
HTTPS424
PostgreSQL363

Top networks (ASNs)

COD12,608
IR-THR-PTE2,925
KREDIT-AS2,061
KOI-AS1,357
LIMITEDNETWORK-AS1,301
SEPEHR-SABZ-DC-TEH543
FARASOSAMANEHPASARGAD500
VIRTUO214

Sample request paths

/ 443 /vpn/index.html /favicon.ico /pbxapi/manager/originate

Open the live view →