Attack traffic from The Netherlands
Honeypot telemetry for sources geolocated to The Netherlands
Observed by OffSeq honeypot sensors · last 30 days · last seen 11 minutes ago · first observed 2026-09-25 (29 days ago)
1,126,289
Attacks
1,569
Distinct source IPs
882
KEV exploit hits
Attack traffic is led by LEASEWEB-NL-AMS-01 Netherlands, most often targeting CVE-2017-9841.
OffSeq honeypot sensors recorded 1,126,289 attacks from 1,569 distinct hosts geolocated to The Netherlandsin the last 30 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.
CVEs targeted
- CVE-2017-9841344
- CVE-2019-0708169
- CVE-2024-4577151
- CVE-2021-26855138
- CVE-2024-2389757
Techniques
- T1110 Brute Force543,866
- T1105 Ingress Tool Transfer213,183
- T1595 Active Scanning96,437
- T1190 Exploit Public-Facing Application94,184
- T1657 Financial Theft43,690
- T1021.005 VNC36,919
- T1552 Unsecured Credentials21,322
- T1046 Network Service Discovery7,064
- T1595.002 Vulnerability Scanning6,184
- T0846 Remote System Discovery1,481
- T1552.001 Credentials In Files1,390
- T1059 Command and Scripting Interpreter659
Top networks (ASNs)
- LEASEWEB-NL-AMS-01 Netherlands235,832
- ROUTERHOSTING212,972
- Online SAS115,893
- TECHOFF SRV LIMITED100,811
- AS49870-BV74,885
- IST-AS45,284
- NEXTGENWEBS-NL44,508
- SERVICES-1337-GMBH39,250
- LITESERVER28,659
- BATTLEHOST BattleHost24,225
- KREDIT-AS18,327