Attack traffic from Russia
Honeypot telemetry for sources geolocated to Russia
Observed by OffSeq honeypot sensors · last 30 days · last seen 6 minutes ago · first observed 2026-09-25 (29 days ago)
226,717
Attacks
1,066
Distinct source IPs
124
KEV exploit hits
Attack traffic is led by MAERSKDRILLINGNETWORK, most often targeting CVE-2019-0708.
OffSeq honeypot sensors recorded 226,717 attacks from 1,066 distinct hosts geolocated to Russiain the last 30 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.
CVEs targeted
Techniques
- T1110 Brute Force172,260
- T1021.005 VNC21,124
- T1190 Exploit Public-Facing Application13,007
- T1210 Exploitation of Remote Services500
- T1595 Active Scanning454
- T1046 Network Service Discovery329
- T1595.002 Vulnerability Scanning216
- T1059 Command and Scripting Interpreter193
- T1187 Forced Authentication60
- T1498.002 Reflection Amplification39
- T1552 Unsecured Credentials25
- T0846 Remote System Discovery18
Top networks (ASNs)
- MAERSKDRILLINGNETWORK47,405
- PROTON6637,594
- -Reserved AS-29,465
- ROSTELECOM-AS PJSC Rostelecom23,071
- ADMINVPS17,005
- PINDC-AS13,418
- FIRST-SERVER-EUROPE10,302
- CLOUVIDER Clouvider - Global ASN7,829
- FIRSTBYTE-AS6,465