Attack traffic from Norway
Honeypot telemetry for sources geolocated to Norway
Observed by OffSeq honeypot sensors · last 30 days · last seen 4 hours ago · first observed 2026-09-25 (29 days ago)
2,710
Attacks
28
Distinct source IPs
Attack traffic is led by BLIX.
OffSeq honeypot sensors recorded 2,710 attacks from 28 distinct hosts geolocated to Norwayin the last 30 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.
Techniques
- T1190 Exploit Public-Facing Application1,195
- T1595 Active Scanning987
- T1046 Network Service Discovery253
- T1078 Valid Accounts75
- T1552 Unsecured Credentials55
- T1110 Brute Force29
- T1595.002 Vulnerability Scanning28
- T1530 Data from Cloud Storage17
- T1589 Gather Victim Identity Information16
- T1505.003 Web Shell10
- T1498.002 Reflection Amplification10
- T1657 Financial Theft9
Top networks (ASNs)
- BLIX2,369
- Microsoft Corporation152
- GIGAHOST60
- CDN77 _2