August 24, 2026weekly roundup

Week of August 17-23, 2026: KrystalView Phish and a Honeypot Full of SSH Noise

Phishing dominates URLs, Amazon hosts most hostile payloads, and SSH runs the honeypot show.

#weekly-roundup#threat-intelligence#phishing#honeypot#malware#threatdrop#blackdome

Most interesting finding

This week we saw a clear phishing playbook surface: 86 phishing URLs out of 215 detonations and repeated impersonation of KrystalView — the top spoofed brand with 4 impersonations (28.6% of identified brands). Phishers leaned on reply-chain social engineering (many messages titled like “RE: Your AWS Abuse Report”) and tracking domains hosted on large cloud providers.

Email trends and lures

  • Total emails analyzed: 414.
  • Threat mix: 158 malware, 67 phishing, 49 spam, 138 safe, 2 credential-theft.
  • Top impersonated brands: KrystalView (4), Geek Squad (2), DHL Express (1), HaltState (1), Qantas (1).
  • Top lure families: dominated by a generic “other” category (398), with smaller counts for callback_scam (4), mfa_reset (3), invoice (1), and account_recovery (1).

Notable email subjects we observed include multiple “Verify your KrystalView email” phishing attempts and a string of reply-chain messages pretending to be AWS abuse responses with tracking hosts (track.pstmrk.it) delivering both phishing and malware. Risk scores on those notable items ranged from 85 to 90.

ThreatDrop highlights (URLs & abuse)

  • URL detonations processed: 215.
  • Hostile URLs identified: 108 (of which 86 phishing, 22 malware).
  • Abuse reports sent: 84; takedowns confirmed: 84 across 2 providers.
  • Phone scams: 1 scam number reported to carriers; carrier engaged: Telimize, LLC.
  • Top hostile hosting providers: AMAZON-02 - Amazon.com, Inc., US hosting 83 malicious URLs, and IDNIC-IKUBARU-AS-ID - PT Ikubaru Indonesia with 1.

IOC-style items (non-sensitive):

  • Tracking domains used in reply-chain lures: track.pstmrk.it with observed resolving hosts including 34.254.126.178, 54.170.231.22, 108.131.191.228, 108.131.191.228 (repeated across multiple high-risk phish), and 34.254.126.178. These IPs repeatedly appear in phishing items with risk scores 85–90.

File detonation — Honeypot captures

  • Total honeypot detonations (files): 643.
  • Verdicts from honeypot: 533 malware, 109 suspicious, 1 exploit.
  • Honeypot reliability: handled separately from submissions below.

File detonation — Submissions

  • User submissions detonated: 1.
  • Submission verdicts: 1 suspicious.

File detonation — Reliability

  • Total file detonations across systems: 644 (643 honeypot + 1 submission).
  • Failures: 0 — reliability 100%.
  • LLM override counter: 0 (no hostile-origin rows where LLM returned safe and policy overrode it).

Honeypot telemetry and credentials capture

  • Total honeypot events: 3,655,533.
  • Unique attacking IPs observed: 16,972; sessions: 48,796.
  • Credentials captured: 549,888 total.
  • Top protocols observed (honeypot events): ssh (1,088,693), smb (1,031,127), telnet (1,007,977), http (172,139), ftp (118,368), https (108,164), smtp (30,686), mysql (29,791).
  • Top credentials-by-protocol: ssh (533,757) dominates, then ftp (10,439), mysql (3,390), postgresql (2,112).

Top attacking IPs (by connection volume):

  • 115.242.182.134 — 282,175 events
  • 119.148.8.45 — 174,592 events
  • 203.160.80.134 — 138,418 events
  • 194.50.16.36 — 136,593 events
  • 152.203.108.45 — 104,168 events

Note: top source countries list is empty in this dataset.

Edge and network signals

Edge events per node indicate active collection across our fleet; top nodes by event count included blkdm-blr-02 (31,713) and blkdm-lon-02 (19,482). Expect regional skew based on sensor placement.

Notable patterns and analyst takeaways

  • Cloud providers remain the go-to hosting layer for mass phishing/malware drops: 83 of 108 hostile URLs were on Amazon-hosted infrastructure. Abuse reporting worked — we sent 84 reports and received 84 takedowns — but the scale problem persists when adversaries spin up new instances.
  • KrystalView impersonations are small in absolute count (4) but notable given repeated subject lines and high risk scores. Those phish used reply-chain credibility and tracking hosts to bypass cursory checks.
  • The honeypot shows heavy automated brute-force and credential-collection activity on SSH, underscoring why SSH hardening and key hygiene remain non-negotiable.
  • Dangerous convergence: reply-chain social engineering + cloud-hosted tracking domains + malware attachments. That combo produced the highest risk scores this week (up to 90).

By The Numbers

  • Emails analyzed: 414
  • Malware emails: 158
  • Phishing emails: 67
  • URL detonations: 215 (hostile: 108) — phishing 86, malicious 22
  • File detonations: 644 total (honeypot 643, submissions 1) — 533 malware verdicts from honeypot
  • Honeypot events: 3,655,533; unique IPs 16,972; sessions 48,796
  • Credentials captured: 549,888
  • Top honeypot protocols: ssh (1,088,693), smb (1,031,127), telnet (1,007,977)
  • Top attacking IPs: 115.242.182.134, 119.148.8.45, 203.160.80.134, 194.50.16.36, 152.203.108.45
  • Abuse reports/takedowns: 84/84

What to watch next

  • Track churn on Amazon-hosted malicious URLs — defenders win if abuse pipelines remain fast.
  • Watch for escalation from KrystalView spoofing into credential-harvest landing pages beyond tracking redirects.
  • Continue SSH-focused detection and credential hardening; the protocol accounts for the vast majority of automated attacks and credential captures.

If you see suspicious mail, forward it to submit@blackdome.ai. Want automation? Check the BlackDome API for programmatic ingestion and reporting.