Attack traffic from Serbia

Honeypot telemetry for sources geolocated to Serbia

Observed by OffSeq honeypot sensors · last 30 days · last seen 8 hours ago · first observed 2026-09-25 (28 days ago)

431

Attacks

Distinct source IPs

Attack traffic is led by TELEKOM-AS.

OffSeq honeypot sensors recorded 431 attacks from 34 distinct hosts geolocated to Serbiain the last 30 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.

Techniques

T1110 Brute Force267
T1190 Exploit Public-Facing Application79
T1595 Active Scanning57
T1595.002 Vulnerability Scanning12
T1210 Exploitation of Remote Services6
T1187 Forced Authentication3
T1552 Unsecured Credentials2
T1552.001 Credentials In Files1
T1046 Network Service Discovery1

Top networks (ASNs)

TELEKOM-AS302
M24739
LATITUDE-SH12
TIMEHOST-AS5

Open the live view → Get this in real time →