Big Picture
This week we saw brute-force style noise at scale paired with surgical email fraud. The honeypot cluster recorded 4,540,812 events and captured 627 file detonations, of which 508 (81%) were labeled malware — that’s not background fluff, it’s active tooling being slung at us. On the email side we analyzed 44 messages and found 1 phishing, 1 credential-theft, and 1 malware message. ThreatDrop detonated 4 URLs, identifying 2 hostile URLs (including 1 phishing instance) hosted predominantly on Amazon infrastructure.
Notable Findings
- Top attacking IPs hitting our honeypots this week: 194.50.16.36 (127,823 events), 146.70.199.195 (100,916), 177.10.63.215 (96,994), 146.190.164.28 (93,371), 217.197.225.226 (56,493). These five IPs account for a huge portion of observed activity and deserve priority blocking and monitoring.
- Impersonated brands in mail: PayPal and Linkt (each observed once, each representing 50% of identified impersonation cases). Lure families included callback_scam and invoice.
- ThreatDrop abuse handling: 0 abuse reports sent, 0 takedowns confirmed, and 1 provider contacted this week. Top hostile hosting provider: AMAZON-02 - Amazon.com, Inc., US (2 malicious URLs).
- Credential captures remain enormous: 728,260 credentials captured across our grid with SSH accounting for 627,205 of those credentials — SSH remains the dominant credential target and vector for automated abuse.
Honeypot Captures
- Total events: 4,540,812
- Unique source IPs: 18,992
- Sessions: 47,293
- Top protocols by event count:
- ssh: 2,264,078
- telnet: 1,103,256
- smb: 486,996
- http: 342,232
- https: 134,362
- smtp: 109,373
- ftp: 24,497
- redis: 22,346
- Top source IPs (summarized): 194.50.16.36, 146.70.199.195, 177.10.63.215, 146.190.164.28, 217.197.225.226.
File Detonations — Honeypot Captures
- Total detonations (honeypot origin): 627
- Verdicts: 508 malware, 119 suspicious
- LLM safe-overrides: 0 — no cases where the model returned safe and policy overrode it.
File Detonations — Submissions
- User submissions processed: 0 (no user-submitted files this week).
File Detonations — Reliability
- Detonation reliability: 100% (627 detonations, 0 failures). Our stack executed every sample without failure.
Email Threats
- Total emails analyzed: 44
- Breakdown: 35 safe, 6 spam, 1 phishing, 1 credential_theft, 1 malware
- Top impersonated brands: PayPal (1), Linkt (1)
- Top lure families: callback_scam (1), invoice (1)
- Notable messages flagged:
- Phishing: “Fw: You can examine the invoice.” (risk score 95)
- Credential theft: “FW: Road Usage Notice.” (risk score 100)
ThreatDrop URL Detonations
- Total URL detonations: 4
- Hostile URLs: 2
- Phishing URLs: 1
- Credential theft URLs: 1
- Malware distribution URLs: 0
- Abuse reporting: 0 reports sent, 0 takedowns confirmed, 1 provider contacted.
- Top hostile host: AMAZON-02 - Amazon.com, Inc., US (2 hostile URLs)
Edge & Infrastructure
- Edge events per node (top nodes): leeroy-syd-01 (26,002), blkdm-hel-01 (9,843), blkdm-tor-02 (9,524), blkdm-nyc-02 (9,511), blkdm-blr-02 (8,802), blkdm-lon-02 (5,263).
- These nodes continue to front most telemetry; Sydney in particular saw a heavy chunk of events.
Credentials Harvested
- Total credentials captured: 728,260
- Top protocols for credential capture:
- ssh: 627,205
- mysql: 97,122
- ftp: 3,529
- smtp: 227
- postgresql: 123
- http: 43
- smb: 9
- https: 2
Notable IOCs (malware & urls)
- SHA256s observed in malware detonations this week (IOC-style listing):
- 1507487e8844f772be9f80ac9e3577b2b32c930e92909c0595cb68821caf6f2f
- 662a4c450a73dd45622856fb0f44cbbeab101a326b89aedbd07ec41c08a5f73b
- 1ea2c148855872f21e9baed6adb8f19f9805791b89f6ad43376b661516c6588f
- Hostile source IPs (repeat offenders): 194.50.16.36, 146.70.199.195, 177.10.63.215, 146.190.164.28, 217.197.225.226
- Note: We are not publishing victim-identifying data. These IOCs are attacker infrastructure and sample hashes only.
By The Numbers
- Period: Week of August 24-30, 2026
- Honeypot events: 4,540,812
- File detonations: 627 (508 malware, 119 suspicious)
- URL detonations: 4 (2 hostile, 1 phishing)
- Emails analyzed: 44 (35 safe, 6 spam, 1 phishing, 1 credential theft, 1 malware)
- Credentials captured: 728,260 (SSH: 627,205)
- Top hostile hosting provider: AMAZON-02 (2 hostile URLs)
What This Means
Automation and credential harvesting are still the name of the game. SSH dominates both protocol traffic and credential capture counts, and a tiny set of IPs and nodes account for disproportionate activity. Email volume was small this week but high in quality for attackers: credential-theft and invoice lures continue to sneak past basic filters when campaigners get crafty.
If you see mail that looks like the examples above or network activity from the listed IPs, treat it as hostile until proven otherwise.
CTA
Spot something weird in your inbox? Forward suspicious emails to submit@blackdome.ai. If you want machine-readable feeds and automated context, check the BlackDome API for ingest and IOC export.