August 10, 2026weekly roundup

Week of August 3-9, 2026 — BlackDome Weekly Roundup

Phishing noise, massive SSH chatter, and malware still dominating honeypot detonations

#weekly#threat-intel#honeypot#detonation#phishing#malware#ssh

Headline: SSH storms and a tiny but dangerous phishing cluster

This week the loudest signal wasn’t from email volume — it was from our honeypots. We observed 1,269,540 SSH events and captured 562,312 SSH credentials, underscoring that opportunistic credential harvesting and brute-force tooling remain the backbone of the attack economy. At the same time ThreatDrop detonations found 3 hostile URLs out of 14 URL detonations, including 1 phishing and 1 malware distribution URL. Small numbers, high fidelity.

What stood out

  • Email analysis: we processed 35 messages and flagged 9 phishing and 3 malware emails. That’s almost one in three suspicious or malicious in this tiny sample.
  • Impersonation: Coinbase topped the impersonation list (1 occurrence; 100% of impersonation hits this week). Expect continued abuse of recognizable crypto brands.
  • Lures: the top lure family was other (19 hits), with invoice appearing once — a reminder that attackers still mix generic and business-themed lures.

Honeypot captures

  • Total events: 3,650,689
  • Unique source IPs: 19,283
  • Sessions: 40,710
  • Top protocols observed:
  • ssh: 1,269,540 events (and 562,312 captured credentials)
  • telnet: 1,098,180 events
  • smb: 819,588 events
  • http: 225,102 events
  • https: 61,325 events
  • Top attacking IPs (by event count):
  • 196.189.255.240 — 181,746 events
  • 194.50.16.36 — 137,135 events
  • 128.199.25.179 — 98,610 events
  • 203.160.68.100 — 87,308 events
  • 115.242.182.134 — 80,325 events

Those five IPs accounted for a disproportionate chunk of activity this week. If you operate edge services, blocklists and rate limits should target sustained noisy sources like these.

File detonations — Honeypot captures

  • Total honeypot detonations: 738
  • Verdicts: 649 malware, 89 suspicious
  • Notable malware detonation SHA256: fed2fbd250c7072cee64cfd6f1ea92dd107f2416da288b8c5e2b773f3ac84002 (detonation id: 224121b3f0cb4a3398330b5c8c6bfaa7)

File detonations — Submissions

  • Total submissions detonated: 2
  • Verdicts: 2 suspicious

File detonations — Reliability

  • Total file detonations: 740
  • Failures: 0 (100% reliability)
  • LLM safe-overrides: 0

We keep honeypot and user-submission channels separate: honeypots provided the bulk of high-confidence malware this week while submissions were limited and flagged suspicious.

Email highlights & notable samples

  • Total emails analyzed: 35
  • 21 safe, 1 spam, 9 phishing, 1 credential theft, 3 malware
  • Notable subjects worth IOCs (no victim data):
  • Phishing: “[2041834D] Licensing Inquiry from r2mepf” — risk score 95
  • Phishing: “FW: Order Confirmation to Owen Moore on 08-06-2026” — risk score 85
  • Credential-theft style: “Fw: Microsoft 365 Account Suspension Notice - Action Required!” — risk score 75
  • Malware: “FW: Today [Date]” — risk score 95

Top impersonated brand this week: Coinbase (1 instance). Lures skewed toward generic “other” family tactics (19 instances) — attackers are casting wide nets.

ThreatDrop snapshot

  • URL detonations: 14 total; 3 hostile (including 1 phishing, 1 malware distribution)
  • Abuse reports sent: 1 (contacted 2 providers; 0 takedowns confirmed)
  • Phone scams: reported 5 scam numbers to carriers; Telimize, LLC received 2 reports that were sent.
  • Top hostile hosting providers detected this week:
  • ENIXLTD - Enix Ltd, GB (1 hostile URL)
  • GOOGLE - Google LLC, US (1 hostile URL)

Edge & credentials

  • Edge events per node (top): blkdm-nyc-02 22,613, leeroy-syd-01 13,281, blkdm-tor-02 10,278
  • Credentials captured: 594,485 total — dominated by SSH (562,312) with MySQL and PostgreSQL trailing.

By The Numbers

  • Period: Week of August 3-9, 2026
  • Honeypot events: 3,650,689 across 19,283 IPs
  • File detonations: 740 (honeypot 738 / submissions 2) — 649 malware verdicts from honeypots
  • URLs detonated: 14 (3 hostile)
  • Emails analyzed: 35 (9 phishing, 3 malware)
  • Credentials captured: 594,485 (SSH: 562,312)

What to do next (TL;DR)

  • Prioritize SSH hygiene: rotate keys, disable password auth, enable rate-limiting and geo-aware controls.
  • Add the top noisy IPs and ephemeral hostile hosts to monitoring and temporary blocklists.
  • Train staff on credential-theft lures and Coinbase/crypto-themed impersonation — even one targeted impersonation can score.
  • Use our detonation and honeypot feeds to enrich detections via the BlackDome API.

If you spot suspicious email or want us to detonate a sample, forward it to submit@blackdome.ai. Integrate our intelligence programmatically — check the BlackDome API for feeds, detonation endpoints, and blocking lists.