The Lead: Your Trusted Cloud Is Someone Else's Attack Infrastructure
Let's start with the uncomfortable truth this week: 13 of the top malicious URLs we detonated were hosted on Google Cloud Platform. Not some sketchy offshore bulletproof hoster — Google Cloud. Akamai came in second with 5 hostile URLs, and Amazon rounded out the podium with 2 more. Attackers are deliberately parking phishing infrastructure on tier-1 cloud providers because reputation-based filters give them a free pass. ThreatDrop flagged them anyway.
Of 91 URL detonations processed this week, 84 came back hostile — that's a 92.3% hostility rate. Of those 84, 83 were phishing and 1 was active malware distribution. We fired off 25 abuse reports to 7 hosting providers. Confirmed takedowns: 0. The providers know. The URLs are still up. Plan accordingly.
---
Email Threat Analysis
This week BlackDome analyzed 22 emails, with 4 confirmed phishing and 18 clean. No malware attachments, no credential-theft campaigns in the submission queue — but the phishing that did show up was aggressive.
Notable high-risk subjects flagged this week:
- "FW: Action Requested: Document Access" — Risk Score: 95/100. Classic business email compromise lure. The forwarded-message format is deliberate social engineering designed to bypass skepticism and create false urgency around document access.
- "Fw: Your subscription has been suspended" — Risk Score: 90/100. Subscription suspension lures remain evergreen because they trigger immediate anxiety. No impersonated brand was confirmed in metadata, but the structure screams credential harvesting.
No top impersonated brands or lure families surfaced in structured data this week, but the lure mechanics above are textbook. If it's forwarded, urgent, and wants you to click — it's probably not from your IT department.
---
Honeypot Intelligence: 6.1 Million Reasons to Patch Telnet
The honeypot grid absorbed 6,130,234 total events this week across 18,974 unique IPs and 136,047 sessions. The internet is not a friendly place.
Top attacked protocols:
- Telnet: 2,395,388 hits — still the king of brute-force targets in 2026. Unbelievable.
- SSH: 2,004,818 hits — automated credential stuffing at industrial scale
- SMB: 898,800 hits — ransomware pre-positioning, lateral movement probing
- HTTP: 341,354 hits
- PostgreSQL: 154,315 hits
- HTTPS: 135,722 hits
- MySQL: 85,060 hits
- FTP: 49,801 hits
Top attacking IPs this week (block these):
- 43.165.176.122 — 734,031 hits. This one IP alone generated more traffic than most enterprise networks see in a month. Nuke it from your ACLs.
- 41.33.255.138 — 160,675 hits
- 128.199.25.179 — 154,816 hits
- 139.59.30.74 — 111,465 hits
- 194.50.16.36 — 108,187 hits
Collectively, these five IPs account for over 1.26 million attack events. They are not scanning casually. They are working.
---
Credential Capture
Across honeypot sessions, BlackDome captured 324,921 credential pairs this week. The breakdown by protocol tells you exactly where attackers are investing their compute:
- SSH: 302,226 — the overwhelming majority. Automated SSH brute-forcers are running 24/7.
- PostgreSQL: 11,420
- FTP: 5,700
- MySQL: 5,283
- HTTP: 232
- HTTPS: 35
- SMTP: 25
If you have SSH exposed to the internet without key-based auth and IP allowlisting, you are actively donating credentials to threat actors. This data proves it.
---
File Detonation
Honeypot Captures
BlackDome detonated 1,176 files sourced from honeypot captures this week. Verdicts: 1,060 confirmed malware and 116 suspicious. That's a 90.1% outright malware rate on files pulled directly from attacker sessions. These aren't gray-area samples.
Notable detonation IOCs from this batch:
- Detonation
0f5d4dbeb94a4ad89cd2f08e5f12e43e— MALWARE — SHA256:1507487e8844f772be9f80ac9e3577b2b32c930e92909c0595cb68821caf6f2f - Detonation
3cb615185414499394505eef0600c4d7— MALWARE — SHA256:72561b01f748cf7d8805f262fdc578df3720021ff7a13f0b59a48ff1bce81e2a - Detonation
f6de2f011c38440bbd9bc241f87f275a— MALWARE — SHA256:7300986cdce6a0beab55be13112370eac475ba2196e2132bd1113bf93d4ec26a - Detonation
be83405ac60247d8881f7c26bc010c9e— MALWARE — SHA256:ed00afa7c9cdd92e4e2dc16bf79073c715dbaf73e318dbc3129bc75a84e9ad58 - Detonation
d3cce07381774c96a48dae9f77d91670— SUSPICIOUS — SHA256:d59e0f98fe48927e0846b4e0550c4a05d3de6fb3de4035e18e1756fcb66c747d
Submissions
No user-submitted files were processed this week. Zero submissions, zero verdicts.
Reliability
Detonation pipeline ran at 100% reliability — 1,176 detonations, 0 failures. The LLM override counter sits at 0: no cases where the model returned a false safe verdict that policy had to correct. Clean week on the infrastructure side.
---
By The Numbers
- 6,130,234 total honeypot events
- 18,974 unique attacking IPs
- 136,047 honeypot sessions
- 324,921 credential pairs captured
- 734,031 hits from the single most aggressive IP (43.165.176.122)
- 91 URL detonations processed
- 84 hostile URLs identified (92.3% hostility rate)
- 83 phishing URLs | 1 malware distribution URL
- 13 malicious URLs hosted on Google Cloud Platform
- 25 abuse reports sent | 0 takedowns confirmed
- 22 emails analyzed | 4 phishing confirmed
- 1,176 files detonated from honeypot captures
- 1,060 confirmed malware | 116 suspicious
- 100% detonation pipeline reliability
---
Take Action
Suspicious email land in your inbox this week? Don't sit on it. Forward it to submit@blackdome.ai and let the pipeline do the work. Every submission sharpens the model and adds to the collective defense.
If you want programmatic access to threat indicators, verdicts, and IOC feeds, the BlackDome API is your entry point. Real-time intelligence, machine-readable, built for teams that don't have time to read blog posts. Check the docs and get integrated.