Attack traffic from Romania
Honeypot telemetry for sources geolocated to Romania
Observed by OffSeq honeypot sensors · last 30 days · last seen 6 minutes ago · first observed 2026-09-25 (29 days ago)
65,150
Attacks
160
Distinct source IPs
3
KEV exploit hits
Attack traffic is led by M247.
OffSeq honeypot sensors recorded 65,150 attacks from 160 distinct hosts geolocated to Romaniain the last 30 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.
Techniques
- T1110 Brute Force43,587
- T1021.005 VNC8,632
- T1190 Exploit Public-Facing Application3,074
- T1595 Active Scanning622
- T1595.002 Vulnerability Scanning442
- T1046 Network Service Discovery244
- T1090 Proxy166
- T1552 Unsecured Credentials82
- T1059 Command and Scripting Interpreter81
- T1552.001 Credentials In Files45
- T1589.002 Email Addresses17
- T1498.002 Reflection Amplification14
Top networks (ASNs)
- M24733,365
- SS-NET7,989
- UNMANAGED-DEDICATED-SERVERS5,523
- SHOCK-1506
- FLOKINET290
- IIC-AS279
- SERVICES-1337-GMBH208
- RCS-RDS 73-75 Dr. Staicovici107
- NETMIHAN57