Lead Finding
This week our honeypots detonated 1,097 files with a staggering 1,003 malware verdicts — that's a ~91.4% malware hit rate on detonations. If you needed a reminder that automated scanners and commodity payloads are still eating the internet's lunch, here it is in cold, ugly numbers.
Email Highlights
- Total emails analyzed: 12
- Threat breakdown: 6 safe, 2 spam, 3 phishing, 1 credential theft, 0 malware.
- Top impersonated brands (each observed once): Lendoraidly, fastandease.com, HaltState — each accounting for ~33.3% of impersonation hits.
- Top lure family: other (11 occurrences) — mostly generic application/job-themed baits.
Notable email lures this week included multiple "Fwd: Regarding your application" threads that scored high risk (up to 95). One credential-theft message (risk 90) used the same application-forwarding narrative — classic inbox recon and reply-chain hijack attempts.
Honeypot Captures
- Total honeypot events observed: 4,922,741 across 15,834 unique IPs and 111,891 sessions.
- Top protocols by event count:
- telnet: 1,964,542 events
- ssh: 1,525,973 events
- smb: 841,018 events
- http: 394,879 events
- https: 54,994 events
- mysql: 44,644 events
- ftp: 35,640 events
- postgresql: 15,435 events
This week was Telnet+SSH bedlam: together they account for nearly 3.5 million connection attempts. Those two protocols alone are where attackers are probing en masse — credential stuffing, opportunistic exploitation, and worm-style scanners.
Top attacking IPs by event volume:
- 138.197.147.76 — 378,331 events
- 74.91.195.12 — 330,565 events
- 193.34.212.136 — 201,214 events
- 146.190.164.28 — 139,481 events
- 127.0.0.1 — 92,073 events
We’re listing these because they’re noisy and persistent — blocklists and monitoring rules should definitely consider them.
File Detonations — Honeypot Captures
- Honeypot detonations: 1,097 total
- Verdicts: 1,003 malware, 94 suspicious
- Notable malware detonations (IOC-style):
- SHA256: 6c084421eb7b69799a06b82f7faa68df6109beedd652ae1b5ea3bdcf3cef1c23 — verdict: malware (detonation: 6f7c87cca4e44986a6364198a5b7bdbb)
- SHA256: a00b30192e5b437f62a2e8e97d043ea02e127ee1ac549bad5af011f36eaaf563 — verdict: malware (detonation: bd5148bec4164c8cae736b8004ba0148)
We keep IOCs limited to hashes and detonation IDs — no victim data. Use these for IOC ingestion and YARA/AV correlation.
File Detonations — Submissions
- Submissions detonations: 0 total
- Verdicts: none
We did not receive any user submissions for detonation this week. Honeypot data is the source of the file verdicts above — do keep that separation in your pipelines.
Reliability
- Total detonations: 1,097
- Total failures: 0 — 100% reliability on detonation runs
- LLM safe-overrides: 0
Our detonation pipeline is stable and deterministic: no failures, no questionable LLM overrides this week.
Credentials & Edge Signals
- Credentials captured: 400,124 total
- Top protocols for captured creds:
- ssh: 387,982
- postgresql: 7,601
- ftp: 2,961
- mysql: 1,192
- smtp: 320
- Edge events per node (top nodes):
- blkdm-blr-02: 88,758 events
- blkdm-hel-01: 56,202 events
- leeroy-syd-01: 39,660 events
- blkdm-lon-02: 33,739 events
SSH dominates credential capture and honeypot interaction — again pointing to credential stuffing and opportunistic SSH brute force as the primary low-effort vector.
Notable Threats This Week
- High-risk phishing and spam variants around application/job threads (risk scores up to 95).
- Persistent scanner IPs (see list above) producing large volumes of telnet/ssh/SMB probes.
- Over 1,000 malware detonations from honeypots — mostly commodity but high volume and consistent.
By The Numbers
- Period: Week of July 20-26, 2026
- Honeypot events: 4,922,741
- Unique source IPs: 15,834
- Sessions: 111,891
- File detonations (honeypot): 1,097 (malware: 1,003, suspicious: 94)
- Submissions detonations: 0
- Email messages analyzed: 12 (safe: 6, phishing: 3, spam: 2, credential theft: 1)
- Credentials captured: 400,124 (SSH: 387,982)
- Top protocol counts: telnet 1,964,542, ssh 1,525,973, smb 841,018
- Top attacking IPs: 138.197.147.76 (378,331), 74.91.195.12 (330,565), 193.34.212.136 (201,214)
Recommendations / Action Items
- Prioritize SSH and Telnet defenses: tighten brute-force protections, rotate keys, and add rate limits.
- Ingest the two SHA256 IOCs into detection tooling and monitor for the listed high-volume source IPs.
- Tune email filters for "application" and "Fwd:" subject chains — they continue to be effective social-engineering lures.
- If you run public-facing SMB or MySQL services, assume they're being probed and pivot to stricter ACLs and telemetry.
CTA
See something suspicious in your inbox? Forward it to submit@blackdome.ai. Want these signals in your stack? Check the BlackDome API for feeds, detonation access, and IOC enrichment.