Attack traffic from Ukraine

Honeypot telemetry for sources geolocated to Ukraine

Observed by OffSeq honeypot sensors · last 7 days · last seen 2026-09-01

5,069

Attacks

Distinct hosts (/16-masked)

OffSeq honeypot sensors recorded 5,069 attacks from 89 distinct hosts geolocated to Ukrainein the last 7 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.

Techniques

T1110 Brute Force2,607
T1190 Exploit Public-Facing Application878
T1021.005 VNC612
T1595.002 Vulnerability Scanning296
T1595 Active Scanning77
T1210 Exploitation of Remote Services13
T1046 Network Service Discovery10
T1090 Proxy3

Services attacked

VNC3,474
HTTP869
HTTPS379
SSH189
Telnet60
SMB13
RDP13

Top networks (ASNs)

VPS-UA-AS2,737
AMARUTU-TECHNOLOGY462
HOSTPRO-AS110
OMEGATECH-AS96
UA-TE-CLOUD53
FLC Pomin51
ONEMBILISIM29
PE Sukonnik Mukola Valeriyovuch17

Sample request paths

/SDK/webLanguage / /vpn/index.html /modules/faxnew/lang/sl.lang /rest/tinymce/1/macro/preview

Open the live view →