August 3, 2026weekly roundup

Week of July 27–August 2, 2026 — Telnet storms and a Microsoft-hosted phishing hit

Large-scale honeypot noise, high-fidelity malware detonations, and a single phishing URL hosted on Microsoft infrastructure

#weekly#threat-intel#honeypot#phishing#malware#threatdrop#blackdome

Lead finding

This week’s loudest signal wasn’t a novel ransomware strain — it was raw volume and focused targeting. Our honeypots processed 3,762,856 events and captured 717 file detonations, of which 631 (88%) were confirmed malware. Meanwhile ThreatDrop processed 2 URL detonations, identifying 1 hostile URL (phishing) hosted on Microsoft infrastructure. Big numbers, clear intent.

What stood out

  • Honeypot scale: 3,762,856 events, 16,346 unique IPs, and 46,433 sessions show broad scanning and opportunistic exploitation across services.
  • Protocol abuse: Telnet and SSH dominate the noise — telnet: 1,333,699 events, ssh: 1,272,390 events — followed by SMB with 720,643 events. If you’re still exposing management services, you’re a target.
  • Top attacking IPs (by event count):
  • 193.34.212.136 — 289,139 events
  • 194.50.16.36 — 143,882 events
  • 183.82.106.44 — 87,715 events
  • 92.204.138.44 — 58,296 events
  • 62.150.36.253 — 52,673 events
  • Malicious hosting: ThreatDrop reported the phishing URL served from MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US; we filed 1 abuse report (no takedown confirmed this week).

Email and lures

We inspected 17 emails this week. Breakdown:

  • Safe: 9
  • Spam: 5
  • Phishing: 3
  • Credential theft and email-delivered malware: 0 each

Top lure family: other (13) — mostly generic lure copy rather than polished brand impersonation. There were no high-frequency impersonated brands this week, but notable phish subjects included:

  • “You Have a New Secure Message” (risk score 95)
  • “Fw: Comcast Advertising - 1540 Broadway…” (risk score 95)
  • “Investments corporation” (risk score 90)

File detonations — separate sections

Honeypot captures

  • Total detonations: 717
  • Verdicts: malware 631, suspicious 86

Submissions

  • Total submissions: 0
  • Verdicts: {} (no user-submitted files this week)

Reliability

  • Reliability: 100% (717 detonations, 0 failures)
  • LLM overrides: 0 hostile-origin rows where an LLM returned safe and policy overrode it

Note: honeypot captures are kept separate from user submissions — the adversary feed is noisy, consistent, and reliable.

Edge & credentials highlights

  • Edge traffic concentrated across nodes; top edge events: blkdm-blr-02 (19,381), blkdm-lon-02 (12,285), and blkdm-hel-01 (10,054).
  • Credential captures remained high at 401,912 total; SSH took the lion’s share (392,324), highlighting automated brute-force/credential stuffing at scale. FTP, PostgreSQL and MySQL accounted for smaller but material shares.

Notable detections & IOCs

  • Malware detonation: sha256: df25b61a0cbcb7854d599d2e4d070e565bd7c051c558cce3a02e672d81fc6aa1 (verdict: malware, detonation id 04efb7812b23407bb2b009f543c9c692)
  • Hostile URL: 1 phishing URL identified and reported; hosted on MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US (abuse report sent)
  • High-volume source IPs (already listed above) — treat as suspicious in network allow/deny lists and telemetry correlation.

Context and takeaways

This week’s pattern is blunt: mass automated scanning and credential harvesting via SSH and legacy services, combined with opportunistic phishing campaigns using generic lure text. There’s no sophisticated brand impersonation surge, but volume and simple phishing still produce results for attackers.

Operational recommendations

  • Harden remote-access services: block Telnet, enforce SSH key-based auth, rate-limit and geo-fence where possible.
  • Monitor and block the five top source IPs across tooling, and feed the SHA256 IOC into detonation and EDR tooling.
  • Treat Microsoft-hosted phishing endpoints as transient but credible: continue filing abuse and correlate URLs with session telemetry.

By The Numbers

  • Period: Week of July 27–August 2, 2026
  • Honeypot events: 3,762,856
  • Unique source IPs: 16,346
  • Sessions: 46,433
  • File detonations: 717 (malware 631, suspicious 86)
  • URL detonations: 2 (hostile/phishing 1)
  • Emails analyzed: 17 (safe 9, spam 5, phishing 3)
  • Credential captures: 401,912 (SSH 392,324)
  • Top protocols by events: telnet 1,333,699, ssh 1,272,390, smb 720,643, http 214,793, https 78,500
  • Top source IPs: 193.34.212.136 (289,139), 194.50.16.36 (143,882), 183.82.106.44 (87,715)

Closing & CTA

If you see anything that looks even a little weird, don’t sit on it — forward suspicious emails to submit@blackdome.ai. Want to automate this? Check the BlackDome API for programmatic detonation, IOC ingestion, and abuse reporting. We eat noise for breakfast so you don’t have to.