AAA Takes the Phishing Crown
This week, threat actors went all-in on AAA impersonation, accounting for 60% of all brand phishing attempts we analyzed. Out of 39 emails processed, 7 were phishing attempts and 1 was credential theft—meaning roughly 20% of inbound mail was actively hostile. The AAA lures were creative, too: subjects like "Elite Access: Your AAA Gear Is Waiting" and "Your Car Rescue Kit Is Ready When You Need It Most" both scored risk scores of 92-95, indicating sophisticated social engineering designed to prey on urgency and brand trust.
Microsoft and PayPal also made appearances, each representing 20% of brand impersonation attempts, but AAA's dominance this week is a reminder that any trusted brand is fair game when attackers need a convincing hook.
Honeypot Chaos: 381K Events, 7K Unique IPs
Our global honeypot network recorded 381,538 events from 7,088 unique IP addresses across 28,697 sessions. The attack surface remains predictable but relentless:
- SMB led the charge with 181,830 events, proving once again that file-sharing protocols are catnip for automated scanners and ransomware operators.
- SSH wasn't far behind at 154,443 events, with attackers hammering credential brute-force attempts around the clock.
- Telnet (14,081), HTTP (14,037), and PostgreSQL (4,365) rounded out the top five, showing that legacy and database services remain high-value targets.
Geographically, Singapore dominated source traffic with 38,804 events, followed by Germany (20,577), Albania (16,246), France (11,929), and China (9,905). The top offending IP, 146.190.83.66, was responsible for 23,115 events alone—a single host accounting for over 6% of all honeypot activity.
Other notable IPs:
- 49.48.194.181: 15,342 events
- 188.166.189.101: 13,422 events
- 203.160.86.34: 10,313 events
- 62.171.133.187: 9,703 events
If you're running SSH, SMB, or PostgreSQL on the public internet without hardening, you're getting scanned. Constantly.
Credential Harvesting: 4K+ Captures
Our honeypots captured 4,048 credential attempts this week, with SSH leading at 2,993 attempts. PostgreSQL (890), MySQL (112), FTP (35), and SMTP (18) also saw activity. These aren't sophisticated attacks—most are dictionary and default credential sprays—but they work often enough to keep attackers motivated.
ThreatDrop: Minimal Volume, Maximum Hostility
ThreatDrop processed just 2 URL detonations this week, but both were hostile: 1 phishing and 1 credential theft attempt. We contacted 1 hosting provider (AS56971 Cloud, HK) but sent 0 formal abuse reports and achieved 0 takedowns. Low-volume weeks like this are a reminder that threats don't always arrive in floods—sometimes it's the quiet, targeted campaigns that slip through.
By The Numbers
- 39 emails analyzed
- 7 phishing emails detected
- 1 credential theft attempt
- 381,538 honeypot events
- 7,088 unique attacking IPs
- 28,697 attack sessions
- 181,830 SMB probes (top protocol)
- 154,443 SSH attacks
- 4,048 credentials captured
- 60% of phishing impersonated AAA
- 146.190.83.66 (top attacking IP, 23,115 events)
- Singapore (top source country, 38,804 events)
Edge Node Activity
Our distributed edge nodes saw relatively balanced traffic this week, with blkdm-tor-01 logging the most events (192), followed closely by blkdm-blr-01 (176) and blkdm-hel-01 (175). This distribution suggests broad, opportunistic scanning rather than targeted campaigns against specific geolocations.
What This Means
Brand impersonation remains the phishing playbook of choice, and AAA's emergence as the top target this week shows attackers are constantly rotating lures to stay fresh. Meanwhile, the honeypot data confirms what we already know: attackers are automating everything, spraying credentials at scale, and betting on misconfigurations and weak passwords.
If you're defending an organization, prioritize:
- Email authentication (DMARC, SPF, DKIM) to reduce brand impersonation success
- MFA everywhere, especially on SSH, RDP, and database access
- Segmentation to keep critical services off the public internet
- Threat intelligence to block known-bad IPs like the ones we've listed
Stay Sharp
Got a suspicious email? Forward it to submit@blackdome.ai and let our engine tear it apart. Developers and security teams can also integrate real-time threat analysis via the BlackDome API—because the best defense is knowing what you're up against before it lands in your users' inboxes.
Stay paranoid. Stay protected.