Attack traffic from Philippines
Honeypot telemetry for sources geolocated to Philippines
Observed by OffSeq honeypot sensors · last 30 days · last seen 4 hours ago · first observed 2026-09-25 (29 days ago)
18,930
Attacks
266
Distinct source IPs
1,314
KEV exploit hits
Attack traffic is led by IPG-AS-AP Philippine Long Distance, most often targeting CVE-2017-0144.
OffSeq honeypot sensors recorded 18,930 attacks from 266 distinct hosts geolocated to Philippinesin the last 30 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.
CVEs targeted
- CVE-2017-01441,314
Techniques
- T1110 Brute Force16,179
- T1210 Exploitation of Remote Services933
- T1190 Exploit Public-Facing Application680
- T1187 Forced Authentication320
- T1046 Network Service Discovery301
- T1595 Active Scanning138
- T1595.002 Vulnerability Scanning126
- T1021.005 VNC53
- T1059 Command and Scripting Interpreter43
- T1552 Unsecured Credentials9
- T1090 Proxy6
- T1040 Network Sniffing2
Top networks (ASNs)
- IPG-AS-AP Philippine Long Distance9,501
- GLOBE-TELECOM-AS Globe Telecoms2,466
- SMARTBRO-PH-AP Smart Broadband2,431
- ETPI-IDS-AS-AP Eastern Telecoms Phils.1,536
- PTTNET Philippine Telegraph and1,092
- GHOSTYNETWORKS953
- CONVERGE-AS Converge ICT Solutions Inc.536
- UCLOUD-HK-AS-AP UCLOUD INFORMATION87
- BLATANTHOST - Blatant15