Attack traffic from South Africa

Honeypot telemetry for sources geolocated to South Africa

Observed by OffSeq honeypot sensors · last 7 days · last seen 2026-08-31

968

Attacks

Distinct hosts (/16-masked)

OffSeq honeypot sensors recorded 968 attacks from 33 distinct hosts geolocated to South Africain the last 7 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.

Techniques

T1110 Brute Force749
T1021.005 VNC73
T1190 Exploit Public-Facing Application26
T1595 Active Scanning22
T1210 Exploitation of Remote Services20
T1657 Financial Theft18
T1046 Network Service Discovery12
T1071.003 Mail Protocols9

Services attacked

SMB479
VNC342
SMTP53
HTTP28
SIP27
HTTPS22
SNMP12
SSH4

Top networks (ASNs)

NEXONHOST34
MTNNS-AS28
ASLINE-AS-AP ASLINE LIMITED22
SAIX-NET19
Telkom-Internet16
SITA-AS8
HA-VPS-NET6
AFRIHOST SP (PTY) LTD4

Sample request paths

/ /vpn/index.html /about /robots.txt /favicon.ico

Open the live view →