Attack traffic from Saudi Arabia

Honeypot telemetry for sources geolocated to Saudi Arabia

Observed by OffSeq honeypot sensors · last 30 days · last seen 6 hours ago · first observed 2026-09-25 (29 days ago)

3,750

Attacks

431

Distinct source IPs

Attack traffic is led by SAUDINETSTC-AS.

OffSeq honeypot sensors recorded 3,750 attacks from 431 distinct hosts geolocated to Saudi Arabiain the last 30 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.

Techniques

T1110 Brute Force1,837
T1190 Exploit Public-Facing Application1,090
T1595 Active Scanning764
T1210 Exploitation of Remote Services31
T1552 Unsecured Credentials16
T1187 Forced Authentication3

Top networks (ASNs)

SAUDINETSTC-AS2,143
ORACLE-BMC-31898894
MOBILY-AS Etihad Etisalat Company Mobily242
ALJAWWALSTC-AS211
MTC-KSA-AS154
ITC ITC AS number67
ALIBABA-CN-NET Alibaba US Technology Co.16
HWCLOUDS-AS-AP HUAWEI CLOUDS15
M2471

Open the live view → Get this in real time →