Over a Million Knocks at the Door
While most people were firing up grills for the long weekend, threat actors were firing up scanners. BlackDome honeypots absorbed 1,049,991 events across 15,210 unique IPs and 16,787 sessions during the week of May 25–31, 2026. That's not a spike — that's a sustained drumbeat of opportunistic and targeted probing that doesn't care what day it is on the calendar.
The headline number that should make every sysadmin uncomfortable: 46,251 credentials captured across our honeypot infrastructure. The overwhelming majority — 43,867 — came in over SSH. Attackers aren't being subtle. They're brute-forcing the most common remote access protocol on the planet at industrial scale, and a lot of those credentials are probably valid ones being recycled from prior breaches.
PostgreSQL came in a distant second at 1,778 captured credentials, followed by MySQL (315), FTP (248), HTTP (22), SMTP (14), and HTTPS (7). If your database is listening on the public internet without strict IP allowlisting, this week's data is your wake-up call.
Protocol Breakdown: The Usual Suspects, in Force
SSH led all honeypot traffic at 345,984 events, but SMB was right behind it at 320,068 — a reminder that legacy Windows file-sharing protocols remain a favorite target for lateral movement and ransomware staging. Telnet, which should be extinct, still drew 270,754 events. Someone out there has a lot of IoT devices and embedded systems they haven't patched since 2014.
Rounding out the protocol hit list:
- HTTP: 44,799 events
- HTTPS: 23,623 events
- PostgreSQL: 12,877 events
- Redis: 7,869 events
- FTP: 6,127 events
Redis and PostgreSQL targeting in particular signals actors hunting for misconfigured cloud-adjacent services — the kind of quick wins that fuel cryptomining and data exfiltration campaigns.
Top Attacking IPs This Week
Five IPs stood out for sheer volume this week. Block them, log them, and share them:
- 190.221.65.7 — 50,715 events (top offender by a wide margin)
- 183.199.247.143 — 40,015 events
- 195.175.30.58 — 29,519 events
- 85.14.245.122 — 20,183 events
- 128.199.25.179 — 18,220 events
These are not drive-by scanners. Sustained event counts at this level indicate scripted, persistent campaigns — likely automated credential stuffing or vulnerability scanning infrastructure.
File Detonation: Honeypot Captures
Our detonation engine processed 292 files pulled directly from honeypot sessions this week. The verdict breakdown is not pretty:
- Malware: 258
- Suspicious: 34
That's a 99.3% hostile rate on files dropped by attackers who thought they were talking to a real host. These aren't accidental uploads — attackers are actively staging payloads during sessions.
Notable detonations flagged this week (IOCs for your blocklists):
- SHA256: 1507487e8844f772be9f80ac9e3577b2b32c930e92909c0595cb68821caf6f2f (seen in two separate detonations: d0f9d1e22dcc46b78d26989e1f999357 and 8d64371124eb451c94367abfcd458471)
- SHA256: cd665044ead94792830a2942c8278510a800204d9af30a13e409433284012d25 (detonation e872a2b1026a4470a3e2dcb130c37d73)
- SHA256: a592eb6302c4b7de408c64bf8b5a9e8255beb0c9f2a737ec0981dd56f3bf9035 (detonation 81c0bbcefeae421fa43830ba6b4ed131)
- SHA256: eef62361c0827512a3f4151c1b985ffe1c94967d3105bc82abbcf110f9050be2 (detonation 35a30aae18e746cea17ddd503376e761)
The repeated SHA256 across two detonation IDs confirms at least one payload is being deployed from multiple sessions or source IPs — coordinated, not coincidental.
File Detonation: Submissions
No user submissions were processed this week. Zero files, zero verdicts. If you're sitting on something suspicious, don't wait — send it to us.
File Detonation: Reliability
294 total detonations. Zero failures. 100% reliability rate. The engine didn't blink. No LLM safe-label overrides were triggered this week, meaning every verdict came through clean without policy intervention.
Email Analysis: A Quiet Week on the Inbox Front
26 emails analyzed this week, and all 26 came back clean. No phishing, no credential theft, no malware, no spam. No impersonated brands, no active lure families. Enjoy it — these weeks don't come often.
By The Numbers
- 1,049,991 total honeypot events
- 15,210 unique attacking IPs
- 16,787 honeypot sessions
- 46,251 credentials captured
- 43,867 SSH credentials (94.8% of total)
- 345,984 SSH honeypot events
- 320,068 SMB honeypot events
- 270,754 Telnet honeypot events
- 292 honeypot files detonated — 258 malware, 34 suspicious
- 0 user file submissions this week
- 294 total detonations, 0 failures — 100% engine reliability
- 26 emails analyzed — 26 safe
- 5 notable malware SHA256s flagged
Stay Sharp
If something lands in your inbox that doesn't feel right, forward it to submit@blackdome.ai. Our analysis pipeline will tear it apart and get you a verdict fast. And if you want this intelligence piped directly into your SIEM, SOAR, or threat intel platform, the BlackDome API gives you programmatic access to IOCs, verdicts, and honeypot telemetry in real time. Don't just read the threat landscape — integrate it.