SMB Under Heavy Fire
This week's standout story? 143,576 SMB protocol attacks flooded our honeypots—more than SSH, telnet, and HTTP combined. That's 55% of all honeypot traffic targeting a protocol that should never be exposed to the internet. Yet here we are.
The attack volume came from 4,372 unique IPs across 16,163 sessions, with the top offender 119.159.251.11 responsible for 35,302 connection attempts alone. That single IP accounted for 13.5% of all honeypot activity this week. Right behind it: 50.66.93.173 with 20,570 attempts and 138.197.81.20 with 17,914.
Geographically, the US led source countries with 18,763 events, followed by an unknown bloc at 16,185, then Singapore (7,992), Indonesia (4,908), and Germany (3,288). SSH remained the second-most targeted protocol with 88,191 attempts, while our credential traps captured 1,094 username/password pairs—796 via SSH alone.
Phishing Gets Personal: HIT Equipment Impersonation
On the email front, we analyzed 35 messages and flagged 15 threats: 8 phishing, 2 credential theft, and 5 malware payloads. The surprise? HIT Equipment International Pty Ltd was impersonated in 60% of brand abuse cases (3 out of 5). Attackers crafted convincing payroll and bonus-themed lures with subjects like "Payroll Bonus and Adjustment Review_Hit equipment_Ref:#614482" hitting risk scores of 95.
FedEx and Instra Corporation also appeared as impersonated brands, each accounting for 20% of brand abuse. Lure families leaned heavily on "other" tactics (5 instances), followed by invoice scams (2), and single instances of account recovery and MFA reset themes.
Notable threats included:
- "Fw: Package Notification" (phishing, risk score 95)
- "FW: Discount CONFIRMED! Claim Your Window Breaker and Seatbelt Cutter" (credential theft, risk score 95)
- "Urgent: Domain Renewal Payment Failed – Action Required" (phishing, risk score 95)
ThreatDrop: Swiss Hosting and Takedown Struggles
Our ThreatDrop pipeline detonated 70 URLs this week, identifying 21 hostile destinations: 15 phishing sites, 4 malware distributors, and 2 credential theft pages. The hosting breakdown reveals an uncomfortable truth: COMPUTERLINE in Schlierbach, Switzerland hosted 4 malicious URLs—more than any other provider.
Amazon came in second with 3 malicious URLs on AMAZON-02 infrastructure, and Google Cloud Platform tied with 2 URLs. We sent 1 abuse report to 7 providers but secured zero confirmed takedowns. The math isn't encouraging.
We also reported 3 scam phone numbers to carriers, including Bandwidth/Zipwhip Toll-Free and Symbio Networks, with only 1 report successfully transmitted.
By The Numbers
- 260,609 total honeypot events
- 4,372 unique attacking IPs
- 143,576 SMB protocol attacks (55% of traffic)
- 88,191 SSH brute-force attempts
- 1,094 credentials captured (796 via SSH)
- 35 emails analyzed
- 15 email threats detected (8 phishing, 5 malware, 2 credential theft)
- 60% of brand impersonation targeted HIT Equipment International
- 70 URL detonations
- 21 hostile URLs identified (30% hit rate)
- 4 malicious URLs hosted on Swiss infrastructure
- 0 successful takedowns
- Top attacking IPs: 119.159.251.11 (35,302 events), 50.66.93.173 (20,570), 138.197.81.20 (17,914)
- Top source countries: US (18,763), Unknown (16,185), Singapore (7,992)
The Takeaway
SMB attacks dominate the threat landscape when legacy protocols remain exposed. Swiss hosting infrastructure is being weaponized at scale, and takedown response remains glacial. Meanwhile, phishing campaigns are getting hyper-targeted—impersonating niche B2B brands like HIT Equipment with surgical precision.
If you're seeing suspicious emails in your environment, forward them to submit@blackdome.ai for analysis. Need programmatic threat intel? The BlackDome API delivers real-time verdicts, IOCs, and risk scoring to power your security stack.
Stay sharp. The internet is a hostile place, and this week proved it—again.