The Week Attackers Went All-In on SMB
This week, the internet's underbelly showed its favorite target: SMB. Our honeypots logged 87,484 SMB attacks—nearly half of all hostile traffic observed. That's not a typo. Threat actors are still bruteforcing file shares like it's 2015, and they're not slowing down.
But SMB wasn't alone. SSH took second place with 65,411 attacks, followed by Telnet at 13,249. The message is clear: attackers are carpet-bombing legacy protocols, hoping someone left the door unlocked.
One IP in particular deserves a shoutout: 41.33.255.138 hammered our infrastructure with 30,392 events this week. That's more than 16% of all honeypot traffic from a single source. Close behind were 213.149.168.246 (9,617 events) and 138.197.81.20 (6,989 events). If you see these IPs in your logs, you know what to do.
Phishing Season: Norton, PayPal, Microsoft, and Best Buy
On the email front, we analyzed 23 messages and caught 7 phishing attempts and 1 credential theft campaign. Attackers spread their impersonation efforts evenly this week, targeting Norton, Best Buy, PayPal, and Microsoft—each brand accounting for 25% of observed impersonation attacks.
The lures were predictable but effective:
- Invoice scams (3 instances)
- Callback scams (1 instance)
- Account recovery tricks (1 instance)
- A grab bag of "other" social engineering tactics (10 instances)
Notable subject lines that hit high risk scores included:
- "Fw: Greetings" (phishing, risk score 95)
- "Fw: Account Billing" (phishing, risk score 95)
- "Your HaltState magic link" (credential theft, risk score 85)
These aren't sophisticated. They're effective because they're boring. They look like the 47th forwarded email in a chain nobody wanted to be on in the first place.
Credential Harvesting: 2,253 Attempts Captured
Our honeypots didn't just absorb attacks—they captured 2,253 credential pairs this week. The breakdown:
- SSH: 2,110 attempts
- MySQL: 99 attempts
- FTP: 21 attempts
- SMTP: 18 attempts
- PostgreSQL: 5 attempts
Attackers are still betting on default credentials and weak passwords. If your infrastructure uses any of these protocols and you haven't rotated credentials recently, this is your wake-up call.
Geographic Threat Distribution
Where are these attacks coming from? This week's top source countries:
- Unknown (likely Tor/VPN): 5,148 events
- Germany (DE): 4,624 events
- Albania (AL): 4,240 events
- Singapore (SG): 2,217 events
- France (FR): 2,047 events
Germany and Albania leading the pack isn't shocking—both are home to bulletproof hosting and cheap VPS infrastructure. Singapore's presence suggests cloud-hosted attack infrastructure, likely abused EC2 or DigitalOcean instances.
ThreatDrop URL Detonations
Our ThreatDrop sandbox processed 2 URL detonations this week, both confirmed phishing. The hostile URLs were hosted on:
- Amazon (AMAZON-02): 1 malicious URL
- Cloudflare Spectrum: 1 malicious URL
No abuse reports were sent this week, but both providers have been flagged. Attackers continue to leverage trusted infrastructure providers to evade reputation-based blocking.
By The Numbers
- 186,448 total honeypot events
- 4,345 unique attacking IPs
- 5,822 distinct attack sessions
- 23 emails analyzed
- 7 phishing emails detected
- 1 credential theft attempt
- 2,253 credential pairs captured
- 87,484 SMB attacks (46.9% of all traffic)
- 65,411 SSH attacks
- 30,392 events from a single IP (41.33.255.138)
Edge Node Activity
Our global edge network saw the most action in Helsinki (blkdm-hel-01) with 165 events, followed by New York (blkdm-nyc-01) at 99 events. London, Bangalore, and Toronto nodes all logged between 52 and 57 events each.
What This Means for You
If you're running SMB, SSH, or Telnet on internet-facing infrastructure, you're being scanned right now. Attackers aren't getting smarter—they're getting louder. Volume is the strategy.
For email security teams: phishing is alive and well. Invoice scams, fake account alerts, and brand impersonation aren't going anywhere. The brands change, but the tactics don't.
Stay Sharp
Got a suspicious email? Forward it to submit@blackdome.ai and let our detection engine tear it apart. Need to integrate threat intel into your stack? Check out the BlackDome API for real-time phishing and malware detection.
Stay paranoid. Stay protected.