Google Impersonation Is the Lure of the Week
Let's lead with the email threat that scored the highest risk rating of the week: a risk score of 95 on a phishing email impersonating a Google security alert. That same lure fired twice in our capture pipeline, and a companion "Google Verification Code" phish came in at risk score 85. Combined, Google accounted for 75% of all impersonated brands across the 5 phishing emails we analyzed — 3 out of 4 brand-spoofed messages wore Google's face.
The fourth notable phish spoofed usefixline.com, using a domain-expiry panic lure ("⚠️ usefixline.com expired — Site, email & hosting all down") to manufacture urgency and push victims toward credential entry. Risk score: 90. Classic account-recovery playbook dressed up in hosting-provider clothing.
Lure family breakdown for the week: mfa_reset showed up 3 times, account_recovery once, with the bulk of traffic falling into the catch-all "other" bucket (27 messages). If your users are getting MFA reset emails they didn't request, treat it as a red flag — not a coincidence.
The Honeypot Never Sleeps
This week's honeypot numbers are not subtle. The BlackDome sensor network absorbed 1,069,998 total events from 15,959 unique IPs across 12,946 sessions. That's over a million knocks on the door in seven days.
Protocol breakdown tells the story clearly:
- SSH: 386,564 events — credential stuffers and brute-force bots dominating as usual
- SMB: 306,846 events — lateral movement and ransomware pre-positioning still a top priority for attackers
- Telnet: 281,218 events — IoT botnet recruitment alive and well in 2026
- HTTP/HTTPS: 33,582 / 21,163 events — web-layer probing rounding out the top five
- PostgreSQL, Redis, MySQL also drew significant fire at 8,193 / 7,154 / 5,783 events respectively
Top attacking IPs this week (block these if you haven't already):
- 120.48.45.201 — 65,974 events, the week's most aggressive single source
- 47.117.148.169 — 38,412 events
- 121.121.176.36 — 33,218 events
- 196.156.80.171 — 28,783 events
- 185.216.140.186 — 16,924 events
41,602 Credentials Captured — SSH Owns the Leaderboard
Attackers weren't just knocking — they were submitting credentials at scale. Our honeypots captured 41,602 credential pairs this week. SSH accounted for the overwhelming majority at 37,807, followed by PostgreSQL at 3,197 and MySQL at 516. Even FTP managed to surface 50 captures, a reminder that legacy protocols remain live targets.
File Detonation: Honeypot Captures
Of the 249 files pulled directly from honeypot sessions, the verdict was damning: 238 confirmed malware and 11 suspicious — a hostile payload rate of essentially 100%. These are files that attackers themselves dropped or attempted to execute against our sensors. Nothing benign made it through.
File Detonation: Submissions
This week saw 0 user submissions for file detonation. No verdicts to report. If you've got something that's been sitting in your quarantine folder, now's a good time to send it our way.
File Detonation: Reliability
The detonation pipeline ran 1,861 total file detonations with zero failures — a 100% reliability rate. LLM safe-verdict overrides: 0. Every hostile-origin file that our policy flagged was correctly handled without exception.
Notable Malware IOCs
Several detonations this week produced confirmed malware verdicts worth flagging:
- SHA256 1507487e8844f772be9f80ac9e3577b2b32c930e92909c0595cb68821caf6f2f — detected across two separate detonation runs (IDs: 7fd5ad6a, 27507c23)
- SHA256 a592eb6302c4b7de408c64bf8b5a9e8255beb0c9f2a737ec0981dd56f3bf9035 — detonation ID 38e4232a
- SHA256 eef62361c0827512a3f4151c1b985ffe1c94967d3105bc82abbcf110f9050be2 — detected across two detonation runs (IDs: 6ea87a13, 67f8235f)
Add these hashes to your EDR blocklists.
By The Numbers
- 1,069,998 honeypot events logged
- 15,959 unique attacking IPs
- 41,602 credentials captured by honeypots
- 43 emails analyzed; 5 phishing, 8 spam, 30 safe
- 75% of impersonated brand traffic spoofed Google
- 1,861 file detonations; 0 failures (100% reliability)
- 249 honeypot-origin files detonated: 238 malware, 11 suspicious
- 265 total malware verdicts across all detonations
- 0 user file submissions this week
- 0 LLM safe-verdict policy overrides
Stay Sharp
If something hit your inbox this week and it smells off, don't sit on it. Forward suspicious emails directly to submit@blackdome.ai — our pipeline will detonate, score, and feed the intelligence loop. Want programmatic access to IOCs, verdicts, and threat feeds? The BlackDome API has you covered. Integrate once, stay current always.