Attack traffic from Poland
Honeypot telemetry for sources geolocated to Poland
Observed by OffSeq honeypot sensors · last 30 days · last seen 14 minutes ago · first observed 2026-09-25 (29 days ago)
1,026,281
Attacks
249
Distinct source IPs
16
KEV exploit hits
Attack traffic is led by SERVICES-1337-GMBH.
OffSeq honeypot sensors recorded 1,026,281 attacks from 249 distinct hosts geolocated to Polandin the last 30 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.
Techniques
- T1110 Brute Force981,045
- T1595 Active Scanning11,450
- T1190 Exploit Public-Facing Application7,147
- T1021.005 VNC7,109
- T1552 Unsecured Credentials6,077
- T1046 Network Service Discovery129
- T1595.002 Vulnerability Scanning70
- T1059 Command and Scripting Interpreter64
- T1552.001 Credentials In Files54
- T1592 Gather Victim Host Information30
- T1657 Financial Theft24
- T1505.003 Web Shell7
Top networks (ASNs)
- SERVICES-1337-GMBH969,673
- TC DATACENTER LIMITED MANAGED IP SPACE16,947
- CF-GDA16,400
- CDNEXT15,283
- MEVSPACE3,247
- Microsoft Corporation655
- GHOST574
- SKYPASS-AS295
- OVH221
- M247123