The Headline Nobody Wants: 0 Takedowns Out of 24 Reports
Let's start with the number that should annoy every SOC analyst reading this: BlackDome's ThreatDrop engine fired off 24 abuse reports to 11 different hosting providers this week. The result? Zero confirmed takedowns. Not one. That's not a fluke — that's the baseline reality of abuse reporting in 2026. Providers are sitting on malicious infrastructure while we wait.
And who's hosting the worst of it? Akamai Technologies (AKAMAI-AS) takes the crown this week with 11 malicious URLs traced back to their network, followed by Google LLC with 4, and another 4 from unattributed/unknown infrastructure. Cloudflare and Google Cloud Platform round out the list with 2 apiece. Big-name CDNs and cloud providers continue to be the landlords of choice for threat actors who know exactly how slow the eviction process is.
Phishing Is Still King, Malware Isn't Far Behind
Our URL detonation pipeline processed 270 URLs this week and flagged 226 of them as outright hostile — that's an 83.7% hostility rate on anything worth clicking on. Breaking it down:
- 124 phishing URLs — the volume leader, as always
- 55 malware distribution URLs
- 47 credential theft pages
- 33 came back clean
- 10 errored out, 1 flagged as scam
On the email side, we ran 23 messages through full analysis. Only 11 came back safe — less than half. The rest broke down into 8 phishing, 3 credential theft, and 1 malware payload. If you're doing the math, that's a 52% hostile rate on inbound email this week, which is not a number that should make anyone feel good about their inbox hygiene.
Top impersonated brands this week were a mixed bag: Bin Zayed Group, Norton LifeLock, and Geek Squad each accounted for 33.3% of brand impersonation attempts. The lure families leaned heavily on "other" (3 instances) and callback scams (2 instances) — the classic "call this number to resolve your urgent issue" playbook that never seems to go out of style.
A few notable subject lines that crossed our detonation queue: fake "Licensing Inquiry" emails scoring a perfect 100 risk score, a DHL customs fee scam at 90, and an "URGENT: account will be suspended" credential harvester at 85. Classic urgency-driven social engineering, still working.
Honeypots Caught Fire — Literally 4 Million Times
Our honeypot fleet logged 4,088,309 total events this week from 16,354 unique IPs across 93,566 sessions. That's an average of roughly 250 events per unique attacker — automation at scale, not curious humans poking around.
Protocol breakdown tells the real story:
- Telnet: 1,687,108 events — still the top target, because IoT and legacy devices never die
- SSH: 1,553,810 events — brute-force credential stuffing never sleeps
- SMB: 451,931 events — lateral movement reconnaissance is alive and well
- HTTP/HTTPS: 271,031 combined events
- MySQL, FTP, and Redis rounding out the rest
The top five attacking IPs by volume were 85.14.245.122 (223,933 events), 128.199.8.54 (137,061), 74.96.148.154 (81,030), 27.71.230.31 (71,277), and 194.50.16.36 (55,344). If any of these show up in your logs, you already know what to do.
On the credential capture side, our honeypots harvested 460,858 credential attempts, dominated by SSH (310,683) and MySQL (143,805) — attackers are still fishing for database access more than anything web-facing.
File Detonation Sections
Honeypot captures: Our sandbox processed 1,085 total file detonations sourced directly from honeypot capture, returning 951 malware verdicts, 133 suspicious, and 1 exploit. That's an 87.7% outright malware confirmation rate on files dropped by live attackers into our traps.
Submissions: Zero user submissions came through the detonation pipeline this week. Nothing to report here — but that's exactly why we want you sending us your suspicious stuff (see below).
Reliability: Our detonation infrastructure ran at 100% reliability — 1,085 detonations, zero failures. No LLM safe-overrides were triggered either, meaning every hostile-origin sample that should have been flagged, was flagged. No policy interventions needed this week.
Two confirmed malware samples worth noting from this batch: detonation ee22f1e1...b0669 and 89580f04...741bf, both returning clean malware verdicts with SHA256 hashes logged for your threat intel feeds.
By The Numbers
- 270 URLs detonated, 226 confirmed hostile (83.7%)
- 23 emails analyzed, 12 flagged malicious (52% hostile rate)
- 24 abuse reports sent, 11 providers contacted, 0 takedowns
- 1,085 files detonated from honeypot captures, 951 confirmed malware
- 4,088,309 honeypot events across 16,354 unique attacking IPs
- 460,858 credentials captured, led by SSH and MySQL protocols
- 100% detonation infrastructure reliability, zero failures
Get In The Fight
Seeing something weird in your inbox? Forward it to submit@blackdome.ai and let our detonation pipeline do the dirty work. Every submission makes the dataset smarter and the next report sharper. Want this intelligence baked directly into your stack? The BlackDome API gives you programmatic access to real-time phishing, malware, and honeypot intelligence — no waiting for a weekly roundup to know what's coming for you.