Attack traffic from South Korea
Honeypot telemetry for sources geolocated to South Korea
Observed by OffSeq honeypot sensors · last 30 days · last seen 11 minutes ago · first observed 2026-09-25 (29 days ago)
205,152
Attacks
659
Distinct source IPs
7
KEV exploit hits
Attack traffic is led by LGDACOM LG DACOM Corporation.
OffSeq honeypot sensors recorded 205,152 attacks from 659 distinct hosts geolocated to South Koreain the last 30 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.
Techniques
- T1110 Brute Force153,795
- T1021.005 VNC16,388
- T1595 Active Scanning16,140
- T1190 Exploit Public-Facing Application5,542
- T1059 Command and Scripting Interpreter1,437
- T1046 Network Service Discovery268
- T1595.002 Vulnerability Scanning234
- T1505 Server Software Component158
- T1505.003 Web Shell152
- T1071.003 Mail Protocols143
- T1552 Unsecured Credentials87
- T1592 Gather Victim Host Information79
Top networks (ASNs)
- LGDACOM LG DACOM Corporation57,410
- KIXS-AS-KR Korea Telecom38,502
- TENCENT-NET-AP-CN Tencent Building26,942
- Microsoft Corporation19,106
- SKB-AS SK Broadband Co Ltd17,260
- POWERVIS-AS-KR LG POWERCOMM16,310
- AS-ULTAHOST15,522
- ORACLE-BMC-318983,271
- ALIBABA-CN-NET Alibaba US Technology Co.2,110
- UCLOUD-HK-AS-AP UCLOUD INFORMATION888