Attack traffic from Sweden
Honeypot telemetry for sources geolocated to Sweden
Observed by OffSeq honeypot sensors · last 30 days · last seen 5 minutes ago · first observed 2026-09-25 (29 days ago)
17,122
Attacks
506
Distinct source IPs
Attack traffic is led by ESAB-AS.
OffSeq honeypot sensors recorded 17,122 attacks from 506 distinct hosts geolocated to Swedenin the last 30 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.
Techniques
- T1110 Brute Force6,131
- T1190 Exploit Public-Facing Application4,004
- T1021.005 VNC3,651
- T1595 Active Scanning653
- T1090 Proxy317
- T1595.002 Vulnerability Scanning141
- T1059 Command and Scripting Interpreter116
- T1046 Network Service Discovery65
- T1552 Unsecured Credentials32
- T1498.002 Reflection Amplification4
- T1552.001 Credentials In Files2
- T1105 Ingress Tool Transfer2
Top networks (ASNs)
- ESAB-AS3,302
- ORACLE-BMC-318982,321
- W1N1,897
- M2471,698
- SECFIREWALLAS1,198
- AS-VULTR589
- IPO-EU443
- TELE2375
- DFRI-AS Foreningen for digitala fri373
- Microsoft Corporation279
- MITEFLUX-AS273