Attack traffic from Ukraine
Honeypot telemetry for sources geolocated to Ukraine
Observed by OffSeq honeypot sensors · last 30 days · last seen 11 minutes ago · first observed 2026-09-25 (29 days ago)
254,302
Attacks
576
Distinct source IPs
Attack traffic is led by ORG-ISI14-RIPE.
OffSeq honeypot sensors recorded 254,302 attacks from 576 distinct hosts geolocated to Ukrainein the last 30 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.
Techniques
- T1110 Brute Force203,972
- T1021.005 VNC15,619
- T1190 Exploit Public-Facing Application15,456
- T1595.002 Vulnerability Scanning1,114
- T1595 Active Scanning331
- T1210 Exploitation of Remote Services260
- T1059 Command and Scripting Interpreter244
- T1187 Forced Authentication113
- T1046 Network Service Discovery19
- T1552 Unsecured Credentials11
- T1498.002 Reflection Amplification10
- T1552.001 Credentials In Files7
Top networks (ASNs)
- ORG-ISI14-RIPE105,289
- HOSTPRO-AS28,146
- GTT-BACKBONE GTT21,617
- AS-MASTER18,418
- DATACRUNCH3,900
- COLUMBUS-PE-TE2,806
- OMEGATECH-AS2,806
- AMARUTU-TECHNOLOGY2,258
- GREENFLOID-AS1,446
- UKSERVERS-AS UK Dedicated Servers619