Attack traffic from Nepal

Honeypot telemetry for sources geolocated to Nepal

Observed by OffSeq honeypot sensors · last 30 days · last seen 6 hours ago · first observed 2026-09-26 (28 days ago)

1,021

Attacks

349

Distinct source IPs

KEV exploit hits

Attack traffic is led by SUBISU-CABLENET-AS-AP Subisu Cablenet.

OffSeq honeypot sensors recorded 1,021 attacks from 349 distinct hosts geolocated to Nepalin the last 30 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.

Techniques

T1190 Exploit Public-Facing Application938
T1110 Brute Force30
T1210 Exploitation of Remote Services21
T1595 Active Scanning15
T1552 Unsecured Credentials5
T1046 Network Service Discovery4

Top networks (ASNs)

SUBISU-CABLENET-AS-AP Subisu Cablenet156
WLINK-NEPAL-AS-AP WorldLink114
NPTELECOM-NP-AS Nepal94
WEBSURFERNP-AS-NP Websurfer Nepal85
SJN-AS-AP Sajilo Net Pvt Ltd74
VIANET-NP VIA NET COMMUNICATION LTD.61
TECHMINDS-NP TECHMINDS NETWORKS PVT59

Open the live view → Get this in real time →