Attack traffic from Thailand
Honeypot telemetry for sources geolocated to Thailand
Observed by OffSeq honeypot sensors · last 30 days · last seen 13 minutes ago · first observed 2026-09-25 (29 days ago)
76,049
Attacks
468
Distinct source IPs
6
KEV exploit hits
Attack traffic is led by CSLOX-IDC-AS-AP CS LOXINFO Public.
OffSeq honeypot sensors recorded 76,049 attacks from 468 distinct hosts geolocated to Thailandin the last 30 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.
Techniques
- T1110 Brute Force60,875
- T1021.005 VNC7,600
- T1190 Exploit Public-Facing Application1,656
- T1595 Active Scanning463
- T1210 Exploitation of Remote Services168
- T1105 Ingress Tool Transfer116
- T1059 Command and Scripting Interpreter77
- T1046 Network Service Discovery40
- T1187 Forced Authentication38
- T1595.002 Vulnerability Scanning37
- T1040 Network Sniffing7
- T1552 Unsecured Credentials3
Top networks (ASNs)
- CSLOX-IDC-AS-AP CS LOXINFO Public46,388
- AIS-FIBRE-AS-AP AIS Fibre9,568
- TTBP-AS-AP Triple T Broadband Public8,038
- TOT-NET TOT Public Company Limited3,893
- TRUEINTERNET-AS-AP TRUE INTERNET Co.3,516
- UCLOUD-HK-AS-AP UCLOUD INFORMATION985
- SYMPHONY-AP-TH Symphony Communication794
- HWCLOUDS-AS-AP HUAWEI CLOUDS775
- CAT-IDC-4BYTENET-AS-AP CAT TELECOM730
- CAT-AP The Communication Authoity of288
- INET-TH-AS Internet Thailand Company263
- TRUEONLINE-AS-AP True Online226