Biggest Finding
This week the most striking pattern was phishing living on mainstream cloud infrastructure: ThreatDrop detonated 12 URLs and flagged 10 hostile URLs (all phishing). Top hostile hosts were Google properties — specifically GOOGLE - Google LLC, US (2 malicious URLs) and GOOGLE-CLOUD-PLATFORM - Google LLC, US (1 malicious URL). Phishers keep using big-host convenience to scale and stay cheap.
Email Threats and Lures
- Total emails analyzed: 23
- Breakdown: 13 safe, 4 spam, 5 phishing, 1 malware (malicious attachment)
- Top impersonated brands: HaltState (2), ACMEY Industrial Co., Ltd., Interactive Brokers, Angels Partners, PayPal (each 1)
- Top lure families: other (17), mfa_reset (1), callback_scam (1)
Notable subjects this week skewed phishing-heavy: high-risk items included “Fw: Notification of billing summary” (risk 100) and several forwarded impersonation threads scored 85–95. A malware-email titled “Important Account Security Notice: 2FA Device Enrollment Required” was also seen (risk 95) — an attachment triggered a malware verdict in our detonations.
File Detonations
Honeypot captures
- Total events processed in detonations: 540 files sourced from honeypots
- Verdicts: 470 malware, 70 suspicious
- LLM safe-overrides: 0 (no hostile-origin rows where an LLM returned safe and policy overrode it)
Submissions
- Total user submissions detonated: 0 (no submitted files this week)
Reliability
- Detonation reliability: 100% (540 detonations, 0 failures)
We keep honeypot detonations and user submissions separate — all 540 files were honeypot-origin and yielded a worrying 87% malware verdict rate.
Honeypot and Credential Telemetry
- Honeypot total events: 3,599,575 across 50,454 sessions from 20,057 unique IPs
- Credentials captured: 521,840 total
- Top credential protocols: SSH (509,353), PostgreSQL (7,319), FTP (2,811)
Top network protocols observed hitting our sensors:
- telnet: 1,370,363 events
- ssh: 1,127,019 events
- smb: 589,965 events
- http: 263,682 events
- https: 127,813 events
Top attacking source IPs by event count (honeypot telemetry):
- 194.50.16.36 — 145,925 events
- 127.0.0.1 — 99,445 events (localhost traffic observed in capture environment)
- 196.189.255.240 — 78,396 events
- 203.160.68.100 — 74,612 events
- 92.204.128.6 — 57,955 events
Note: top source countries list was empty in the feed this week; we therefore report only IPs.
ThreatDrop URL & Abuse Work
- URL detonations: 12 total → 10 phishing, 2 safe, 0 malware distribution URLs
- Abuse reports sent: 3 to 2 providers, resulting in 0 confirmed takedowns
- Phone reports: 1 scam number identified; reported internally and flagged for carrier escalation (T-Mobile USA listed as a carrier contacted; reports sent = 0)
- Top hostile hosting providers: saw above — Google-hosted infrastructure accounted for the highest count.
Edge and Service Telemetry
Events per edge node (top six): blkdm-blr-02 24,959, blkdm-nyc-02 18,170, leeroy-syd-01 12,131, blkdm-hel-01 11,541, blkdm-tor-02 4,966, blkdm-lon-02 4,561. These numbers show where collection volume is concentrated and guide our sensor tuning.
By The Numbers
- Period: Week of August 10-16, 2026
- Emails analyzed: 23
- Phishing emails: 5
- Malware emails: 1
- URL detonations: 12 (phishing: 10)
- File detonations (honeypot): 540 (malware: 470, suspicious: 70)
- Honeypot events: 3,599,575; sessions: 50,454; unique IPs: 20,057
- Credentials captured: 521,840 (SSH dominated with 509,353)
- Top honeypot protocols: telnet, ssh, smb, http, https
- Top source IPs: 194.50.16.36, 127.0.0.1, 196.189.255.240, 203.160.68.100, 92.204.128.6
IOC-style indicators (abbreviated)
- High-volume attacker IPs: 194.50.16.36, 196.189.255.240, 203.160.68.100, 92.204.128.6
- Hostile hosting providers observed: GOOGLE - Google LLC, US; GOOGLE-CLOUD-PLATFORM - Google LLC, US
- High-risk email subjects to hunt for: “Fw: Notification of billing summary”, “Important Account Security Notice: 2FA Device Enrollment Required”
Do not share victim-specific artifacts publicly; these IOCs are high-level and meant for detection tuning and blocking decisions.
Closing / Action Items
Phishers continue to prefer big-cloud hosting and basic social engineering. Defenders should prioritize robust phishing detection (look for forwarded billing threads and 2FA enrollment bait), block or monitor the attacker IPs listed here, and harden SSH credentials — SSH accounted for the overwhelming majority of captured credentials.
If you spot suspicious email or attachment activity, forward samples to submit@blackdome.ai. Want automated enrichment and blocking? Use the BlackDome API to integrate these signals directly into your tooling.