Attack traffic from South Korea

Honeypot telemetry for sources geolocated to South Korea

Observed by OffSeq honeypot sensors · last 7 days · last seen 2026-08-31

32,299

Attacks

230

Distinct hosts (/16-masked)

OffSeq honeypot sensors recorded 32,299 attacks from 230 distinct hosts geolocated to South Koreain the last 7 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.

Techniques

T1110 Brute Force21,174
T1021.005 VNC6,323
T1190 Exploit Public-Facing Application1,143
T1595 Active Scanning429
T1595.002 Vulnerability Scanning69
T1059 Command and Scripting Interpreter63
T1046 Network Service Discovery56
T1498.002 Reflection Amplification29

Services attacked

VNC21,633
HTTPS8,885
HTTP809
PostgreSQL418
SMTP135
Telnet115
SSH73

Top networks (ASNs)

AS-ULTAHOST5,863
POWERVIS-AS-KR LG POWERCOMM4,747
TENCENT-NET-AP-CN Tencent Building, Kejizhongyi 3,577
KIXS-AS-KR Korea Telecom3,233
LGDACOM LG DACOM Corporation849
SKB-AS SK Broadband Co Ltd823
ORACLE-BMC-31898516
ALIBABA-CN-NET Alibaba US Technology Co., Ltd.453

Sample request paths

/remote/logincheck / /remote/login /config.json /sitemap.xml

Open the live view →