Attack traffic from Russia

Honeypot telemetry for sources geolocated to Russia

Observed by OffSeq honeypot sensors · last 7 days · last seen just now · first observed 2026-10-04 (7 days ago)

65,217

Attacks

249

Distinct source IPs

122

KEV exploit hits

Attack traffic is led by MAERSKDRILLINGNETWORK, most often targeting CVE-2019-0708.

OffSeq honeypot sensors recorded 65,217 attacks from 249 distinct hosts geolocated to Russiain the last 7 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.

CVEs targeted

CVE-2019-0708113

Techniques

T1110 Brute Force51,698
T1021.005 VNC6,017
T1190 Exploit Public-Facing Application1,675
T1210 Exploitation of Remote Services108
T1595 Active Scanning87
T1046 Network Service Discovery71
T1059 Command and Scripting Interpreter62
T1595.002 Vulnerability Scanning33

Services attacked

VNC52,828
SMB6,073
HTTPS2,607
Microsoft SQL Server2,564
SSH528
RDP164
HTTP143

Top networks (ASNs)

MAERSKDRILLINGNETWORK30,891
-Reserved AS-9,094
ROSTELECOM-AS PJSC Rostelecom. Technical Team5,912
PINDC-AS5,071
ADMINVPS3,758
FIRST-SERVER-EUROPE2,455
CLOUVIDER Clouvider - Global ASN1,760
FIRSTBYTE-AS1,547

Sample request paths

/remote/logincheck / /vpn/index.html /remote/login /cgi/login

Open the live view →