Attack traffic from Serbia
Honeypot telemetry for sources geolocated to Serbia
Observed by OffSeq honeypot sensors · last 30 days · last seen 4 hours ago · first observed 2026-08-03 (30 days ago)
15,460
Attacks
22
Distinct source IPs
Attack traffic is led by CNSERVER-AP-AS CNServer LLC.
OffSeq honeypot sensors recorded 15,460 attacks from 22 distinct hosts geolocated to Serbiain the last 30 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.
Techniques
- T1110 Brute Force10,105
- T1021.005 VNC4,993
- T1595 Active Scanning53
- T1190 Exploit Public-Facing Application51
- T1059 Command and Scripting Interpreter27
- T1210 Exploitation of Remote Services19
- T1046 Network Service Discovery16
- T1595.002 Vulnerability Scanning6
- T1187 Forced Authentication3
- T1105 Ingress Tool Transfer2