Attack traffic from South Africa
Honeypot telemetry for sources geolocated to South Africa
Observed by OffSeq honeypot sensors · last 30 days · last seen 15 minutes ago · first observed 2026-09-25 (29 days ago)
34,376
Attacks
766
Distinct source IPs
Attack traffic is led by CLOUVIDER Clouvider - Global ASN.
OffSeq honeypot sensors recorded 34,376 attacks from 766 distinct hosts geolocated to South Africain the last 30 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.
Techniques
- T1190 Exploit Public-Facing Application15,720
- T1110 Brute Force13,797
- T1059 Command and Scripting Interpreter291
- T1021.005 VNC182
- T1595 Active Scanning136
- T1046 Network Service Discovery57
- T1210 Exploitation of Remote Services55
- T1552 Unsecured Credentials24
- T1071.003 Mail Protocols13
- T1595.002 Vulnerability Scanning10
- T1187 Forced Authentication8
- T1592 Gather Victim Host Information1
Top networks (ASNs)
- CLOUVIDER Clouvider - Global ASN24,571
- Vodacom-VB3,228
- LIGHT4-AS-AP LIGHT NODE LIMITED2,313
- METROFIBRE-NETWORX1,568
- AFRIHOST-SP454
- RAIN-GROUP-HOLDINGS212
- INTERNET-SOLUTIONS199
- HWCLOUDS-AS-AP HUAWEI CLOUDS163
- Hero-Telecoms147
- XSERVERCLOUD130
- SAIX-NET128
- Vox-Telecom115