Top Finding
This week the network noise was deafening: our honeypots recorded 3,984,713 events with 1585585 telnet and 1,365,641 SSH protocol hits — and from those captures we detonated 872 files, finding 814 malware verdicts and 58 suspicious items. That’s not a blip. It’s a sustained opportunistic campaign probing legacy services and dropping binaries at scale.
Email and ThreatDrop Highlights
- We analyzed 19 emails this week. 12 were safe, 4 spam, and 3 phishing. No credential-theft or direct malware-in-email samples were seen in inbox submissions.
- ThreatDrop processed 2 URL detonations: 1 phishing and 1 safe. No abuse reports were sent and no takedowns were performed (0 reports, 0 takedowns).
- Top impersonated brand in email lures: Grant Hunter (1 occurrence, 100% of impersonations). Lure family labeled “other” dominated with 16 instances.
Honeypot Intelligence
Honeypot snapshot for the week:
- Total events: 3,984,713
- Unique attacking IPs observed: 15,631
- Sessions: 64,739
Top protocols by event count:
- telnet: 1,585,585
- ssh: 1,365,641
- smb: 631,227
- http: 221,056
- https: 66,528
Top attacking IPs (by observed events):
- 69.6.249.0 — 284,246 events
- 43.110.38.5 — 125,028 events
- 193.34.212.136 — 88,467 events
- 188.166.223.22 — 80,045 events
- 115.242.182.134 — 54,804 events
These numbers point to wide, scripted scanning and brute-force activity focused on old, unencrypted services (telnet/SSH) plus SMB and HTTP-based probing.
File Detonations
Honeypot captures
- Total detonations (honeypot-origin): 872
- Verdicts: 814 malware, 58 suspicious
- Notable malware SHA256s observed (IOC-style):
- 0a8abd5751bfac39b2a42b4bb4e64f2c1f8b1de784bf656a701f5689f1a5d2c8
- 72561b01f748cf7d8805f262fdc578df3720021ff7a13f0b59a48ff1bce81e2a
- 6fe6c2bb12350fa802ae46da127f0b19868c6e385ed8dac07c72c4ec4b678638
- 1507487e8844f772be9f80ac9e3577b2b32c930e92909c0595cb68821caf6f2f
- (suspicious) 3e16fdab899b1ffe4f7def5783cfdc390bc5f6e1de1fee9568032b18af3da8b5
Submissions
- User submissions: 0 total this week. No user-sent files were processed; honeypot-origin material dominates our detonation set.
Reliability
- Detonation reliability: 100% (872 detonations, 0 failures)
- LLM overrides: 0 — no instances where an LLM returned safe and policy overrode to hostile.
Edge & Credential Signals
- Edge events concentrated in our NYC node: blkdm-nyc-02 recorded 68,536 events, followed by blkdm-blr-02 with 25,206.
- Credentials captured across protocols: 489,302 total. Top credential sources:
- SSH: 373,082
- MySQL: 104,960
- PostgreSQL: 9,080
High-volume credential captures align with the heavy SSH telnet scanning — attackers are still fishing for exposed credentials en masse.
Notable Samples & Subjects
- Notable email subjects flagged: “AI Fire sent you a message” (spam, risk 85), and phishing sample “Fw: Account Information Update Required ID-1852112588” (risk 85).
- Malware detonations included multiple confirmed binaries (see SHA256 list above) — treat those as high-confidence IOC candidates.
By The Numbers
- Period: Week of July 13-19, 2026
- Email analyzed: 19
- Safe: 12
- Spam: 4
- Phishing: 3
- Honeypot events: 3,984,713; unique IPs 15,631; sessions 64,739
- File detonations: 872 (honeypot); 814 malware, 58 suspicious
- URL detonations: 2 total; 1 phishing, 1 safe
- ThreatDrop abuse reports: 0
- Credentials captured: 489,302 (SSH top at 373,082)
What This Means
Attackers are leaning on volume and legacy-protocol abuse. The huge telnet/SSH counts and massive credential haul tell a simple story: broad sweeping scans feeding automated deployment chains that drop and execute payloads. Email volume was small but noisy — one impersonation of “Grant Hunter” and several high-risk phishing subjects made the cut.
If you run internet-facing services, assume probes are constant. Prioritize: disable telnet, rate-limit SSH, enforce key-based auth, monitor SMB endpoints, and vet inbound email subjects that match the patterns above.
Actionable IOCs (do not expose victim data)
- Malicious SHA256s (observed in honeypot detonations):
- 0a8abd5751bfac39b2a42b4bb4e64f2c1f8b1de784bf656a701f5689f1a5d2c8
- 72561b01f748cf7d8805f262fdc578df3720021ff7a13f0b59a48ff1bce81e2a
- 6fe6c2bb12350fa802ae46da127f0b19868c6e385ed8dac07c72c4ec4b678638
- 1507487e8844f772be9f80ac9e3577b2b32c930e92909c0595cb68821caf6f2f
- Phishing URL detonations: 1 hostile URL detected (details available via BlackDome API / ThreatDrop export)
- High-activity source IPs to watch: 69.6.249.0, 43.110.38.5, 193.34.212.136, 188.166.223.22, 115.242.182.134
Wrap-up & CTA
If you see anything suspicious in your inbox or logs, forward samples and headers to submit@blackdome.ai. You can also pull these IOCs, full detonation data, and live URL verdicts via the BlackDome API — integrate it, automate it, sleep better.
Stay loud. Stay paranoid. Stay ahead.