Attack traffic from Luxembourg

Honeypot telemetry for sources geolocated to Luxembourg

Observed by OffSeq honeypot sensors · last 30 days · last seen 14 hours ago · first observed 2026-09-25 (29 days ago)

3,487

Attacks

Distinct source IPs

KEV exploit hits

Attack traffic is led by PONYNET.

OffSeq honeypot sensors recorded 3,487 attacks from 28 distinct hosts geolocated to Luxembourgin the last 30 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.

Techniques

T1021.005 VNC2,049
T1190 Exploit Public-Facing Application219
T1110 Brute Force92
T1595.002 Vulnerability Scanning21
T1595 Active Scanning19
T1046 Network Service Discovery13
T1552 Unsecured Credentials6
T1552.001 Credentials In Files5
T1210 Exploitation of Remote Services3

Top networks (ASNs)

PONYNET3,419
ESTNOC-GLOBAL17
G-Core Labs S.A.15

Open the live view → Get this in real time →