Microsoft SQL Server attacks & scanning (port 1433)
MSSQL pre-login — login brute force and tooling fingerprints.
Observed by OffSeq honeypot sensors · last 30 days · #4 most-attacked service · last seen 2 minutes ago
2,041,495
Attacks
3,847
Distinct source IPs
1433
Port · tcp
The #4 most-attacked service across the fleet in the last 30 days.
OffSeq honeypots emulating Microsoft SQL Server recorded 2,041,495 attacks from 3,847 distinct source IPs over the last 30 days. MSSQL pre-login — login brute force and tooling fingerprints.
Top CVEs exploited across the fleet (last 30 days)
Fleet-wide, not scoped to Microsoft SQL Server.
- CVE-2017-01442,731
- CVE-2019-07082,655
- CVE-2024-45771,682
- CVE-2021-268551,652
- CVE-2017-9841542
- CVE-2025-5777269
- CVE-2023-3519150
- CVE-2012-212283