Attack traffic from Russia

Honeypot telemetry for sources geolocated to Russia

Observed by OffSeq honeypot sensors · last 7 days · last seen 2026-08-31

49,882

Attacks

188

Distinct hosts (/16-masked)

KEV exploit hits

OffSeq honeypot sensors recorded 49,882 attacks from 188 distinct hosts geolocated to Russiain the last 7 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.

CVEs targeted

CVE-2019-070815
CVE-2017-01445

Techniques

T1110 Brute Force43,104
T1021.005 VNC3,488
T1595 Active Scanning391
T1190 Exploit Public-Facing Application200
T1210 Exploitation of Remote Services112
T1059 Command and Scripting Interpreter98
T1046 Network Service Discovery30
T1552 Unsecured Credentials18

Services attacked

VNC41,177
Microsoft SQL Server6,187
SMB1,573
HTTP447
Telnet181
HTTPS89
Redis47

Top networks (ASNs)

MAERSKDRILLINGNETWORK38,003
INSYS-AS INSYS ISP3,094
VPSDEDIC-AS2,382
MF-KAVKAZ-AS1,098
VEESP-LV-AS637
ABKHAZMEDIA-AS523
ROSTELECOM-AS PJSC Rostelecom. Technical Team444
MTS-CLOUD326

Sample request paths

/ /.git/HEAD /.git/index /wp-login.php /.git/logs/refs/heads/production

Open the live view →