July 13, 2026weekly roundup

Week of July 6-12, 2026 — Honeypots scream telnet, phishing leans on Passionfroot

Massive credential grabs on SSH, telnet noise from a handful of IPs, and Passionfroot impersonation dominates email lures.

#weekly-roundup#threat-intel#honeypot#phishing#credentials#blackdome

Headline Finding

This week we saw brutal credential harvesting at scale and a surprisingly concentrated noisy footprint: 334,412 credentials captured, with 318,351 from SSH alone, while honeypot events peaked on telnet and SSH traffic. On the email side, impersonation is dominated by a single brand—Passionfroot—appearing in 5 email attacks (41.7% of impersonations). Attackers moved fast and noisy; defenders should too.

Email and Phish Trends

  • Total emails analyzed: 40. Breakdown: 15 safe, 14 spam, 4 phishing, 6 malware, 1 credential-theft.
  • Top impersonated brands: Passionfroot (5, 41.7%), KrystalView (2, 16.7%), Geek Squad, DHL Express, and Liverpool / Suburbia (each 1, 8.3%). Callout: Passionfroot-themed lures are the loudest signal this week—treat anything bearing that brand with suspicion.
  • Lure families: dominated by other (27), with small counts for invoice (2), mfa_reset (2), and callback_scam (1). Invoice and shipment phishes were among the highest-risk subjects (risk score 95 for two phishing emails).
  • Notable subjects to watch: “Fw: In_voice update transaction details” and “Shipment held – fee required” (both phishing, risk 95). High-risk malware phishes included Spanish-language Liverpool-themed lures and an aggressive “We held your amount” variant (risk 85–90).

ThreatDrop URL Detonations

  • URLs detonated: 18 total. Hostile: 10 (including 4 phishing and 4 malware distribution). Safe: 7.
  • ThreatDrop filed 4 abuse reports to hosting providers; confirmed takedowns: 0 across 4 providers.
  • Top hostile hosting providers: GOOGLE-CLOUD-PLATFORM (Google LLC, US) — 2 malicious URLs; DEPKES-AS-ID (Departemen Kesehatan, ID) — 1; GOOGLE (Google LLC, US) — 1; Telegram (Telegram Messenger Inc, VG) — 1.
  • Quick IOC-style notes (no victim data): monitor and block or alert on URLs and domains associated with the hosters above when observed in phish clusters or high-risk campaigns.

File Detonations — Honeypot Captures

  • Honeypot captures: 908 file detonations originating from honeypots.
  • Verdicts: 829 malware, 78 suspicious, 1 exploit.
  • These are pure honeypot-origin samples — high signal. Prioritize detection and signatures from the malware cluster; nearly 91% of honeypot files were confirmed malicious.

File Detonations — Submissions

  • Submissions: 0 total. No user-submitted files for this period.

File Detonations — Reliability

  • Reliability: 100% (908 detonations executed, 0 failures).
  • LLM overrides: 0 cases where the model returned safe and policy overrode to hostile.

Honeypot & Network Noise

  • Total honeypot events: 3,980,203 across 15,328 unique IPs and 117,549 sessions — this is noisy infrastructure testing and opportunistic scanning.
  • Top protocols observed: telnet (1,685,420 events), ssh (1,409,943), smb (507,919), http (206,202), https (75,083), postgresql (27,550), ftp (16,628), mongodb (13,137). The telnet/SSH dominance underscores legacy-protocol opportunism.
  • Top attacking IPs by event count (honeypot):
  • 69.6.249.0 — 370,174 events
  • 146.190.164.28 — 161,025 events
  • 125.31.0.18 — 160,648 events
  • 122.4.66.98 — 88,132 events
  • 157.245.56.194 — 76,961 events
  • These IPs are the usual suspects for sweeping scans and credential stuffing; escalate to blocklists if they repeatedly target production assets.

Credentials Harvested

  • Total credentials captured: 334,412.
  • By protocol: SSH 318,351, PostgreSQL 12,299, FTP 2,117, MySQL 1,537, HTTP 76, SMTP 18, HTTPS 14.
  • SSH is the prize target. Ensure key-based auth, rate-limits, and geo/reputation restrictions for exposed SSH endpoints.

Edge and Delivery Observations

  • Events per edge node show typical distribution with blkdm-nyc-02 at 86,235 events leading the pack.
  • Delivery pipelines still funnel malicious content through major cloud providers; abuse reporting had no takedowns this week — cloud hosting continues to be weaponized.

By The Numbers

  • Period: Week of July 6-12, 2026
  • Emails analyzed: 40
  • URL detonations: 18 (hostile 10, phishing 4, malware 4)
  • File detonations: 908 (honeypot-origin; 829 malware, 78 suspicious, 1 exploit)
  • Honeypot events: 3,980,203
  • Unique source IPs: 15,328
  • Credentials captured: 334,412 (SSH 318,351)
  • Top honeypot protocols: telnet (1,685,420), ssh (1,409,943), smb (507,919)
  • Top attacking IPs: 69.6.249.0, 146.190.164.28, 125.31.0.18, 122.4.66.98, 157.245.56.194

What This Means for Defenders

  • Harden SSH now: key-only auth, fail2ban/rate limits, and network controls. The volume of SSH credential captures means opportunistic actors are crawling wide and fast.
  • Watch for Passionfroot-themed phishing. High volume and repeat impersonation make it a reliable signal for blocking and user training.
  • Cloud providers are still abused for hosting hostile URLs. Don’t expect quick takedowns — build detections and pre-emptive blocks.
  • Use telemetry from honeypots (top IPs/protocols) to seed internal detection and threat intel feeds.

Actionable IOCs (watchlist)

  • IPs: 69.6.249.0, 146.190.164.28, 125.31.0.18, 122.4.66.98, 157.245.56.194
  • High-volume protocols to monitor: telnet, ssh, smb
  • Email indicators: subjects matching invoice/shipment lures and Passionfroot impersonation patterns

Forward suspicious emails to submit@blackdome.ai for analysis. If you’re integrating at scale, our BlackDome API can ingest samples, return verdicts, and enrich your detections programmatically.

Stay sharp — the noise is the signal if you listen for the right frequencies.