Honeypot Mayhem: Three-Quarters of a Million Attacks
This week our global honeypot network absorbed 779,468 malicious events from 14,386 unique IPs across 10,696 distinct sessions. The threat landscape continues to favor the classics: Telnet dominated with 305,557 attempts, followed closely by SMB at 232,857 and SSH at 173,177. Legacy protocols remain the low-hanging fruit attackers can't resist.
The most aggressive single IP this week? 120.48.45.201 hammered our infrastructure with 53,484 connection attempts, with 118.194.239.74 close behind at 51,149. Rounding out the top five were 118.69.186.162 (23,420 attempts), 14.103.242.123 (18,874), and 190.215.192.21 (11,712). If you're seeing traffic from these addresses, it's not friendly.
Credential Harvesting at Scale
Attackers collected 20,728 credentials this week across our decoy infrastructure. SSH remains the protocol of choice for credential stuffing, accounting for 18,795 captures—over 90% of the total. PostgreSQL (1,221) and MySQL (625) rounded out the database targeting, while legacy protocols like FTP (38) and SMTP (28) still see action.
These aren't sophisticated attacks. They're volume plays, and they work because too many organizations still run default credentials or weak passwords on internet-facing services.
Email Threats: Phishing Dominates, Brands Get Abused
We analyzed 29 emails this week, and the threat breakdown tells a familiar story: 8 phishing attempts, 4 malware payloads, and 2 credential theft campaigns. Only 15 messages were genuinely safe.
Deloitte Digital Australia and Geek Squad each appeared in 50% of brand impersonation attempts—a tie for the dubious honor of most-abused brand this week. Lure families leaned heavily on invoice-themed social engineering (11 "other" category lures, 2 invoice-specific), with 1 callback scam attempt making an appearance.
Notable subject lines that should raise immediate red flags:
- "Permanent data loss warning—Backup failed: Files not saved" (credential theft, risk score 95)
- "Payment Confirmation" (phishing, risk score 95)
- "ABOUT YOUR FUNDS" (phishing, risk score 92)
- "Complete Document E-sign Agreement Review" (credential theft, risk score 87)
If an email creates urgency around payment, data loss, or document signing, treat it as hostile until proven otherwise.
File & URL Detonations: High Malware Rates Across the Board
Honeypot Captures
Our honeypots snagged 142 files this week, with a grim verdict distribution: 132 confirmed malware samples and 10 suspicious files. That's a 93% malware rate—these aren't borderline cases.
User Submissions
Community submissions totaled 5 files: 3 suspicious and 2 benign. Keep those submissions coming—every sample strengthens our detection models.
Detonation Reliability
Our sandbox infrastructure maintained 100% reliability across 147 total detonations with zero failures. The LLM override counter remained at 0, meaning our AI-assisted verdict system and policy engine are in perfect agreement.
ThreatDrop: Google Hosts the Bad Guys
ThreatDrop processed 4 URL detonations this week, identifying 4 hostile URLs: 2 phishing sites, 1 credential theft page, and 1 malware distribution point. We sent 3 abuse reports to hosting providers, contacting 1 provider total. Confirmed takedowns? Zero.
The most alarming finding: GOOGLE (Google LLC, US) hosted 3 of the 4 malicious URLs we detected. Cloud infrastructure remains a favorite for threat actors because it's fast, trusted by security tools, and hard to take down quickly. Attackers know that URLs hosted on Google infrastructure are less likely to be blocked by default.
By The Numbers
- 779,468 total honeypot events
- 14,386 unique attacking IPs
- 20,728 credentials captured
- 305,557 Telnet connection attempts (top protocol)
- 29 emails analyzed
- 14 malicious emails detected (phishing, malware, credential theft)
- 147 file detonations (100% reliability)
- 132 confirmed malware samples from honeypots
- 4 hostile URLs detected
- 3 malicious URLs hosted on Google infrastructure
- 0 confirmed takedowns this week
What This Means for You
The threat landscape isn't getting quieter. Attackers continue to exploit legacy protocols, abuse trusted cloud providers, and weaponize urgency in social engineering campaigns. The data doesn't lie: if you're running internet-facing Telnet, SMB, or SSH with weak credentials, you're already compromised—you just don't know it yet.
Brand impersonation remains effective because it works. Deloitte and Geek Squad emails get opened. Invoice lures get clicked. Credential theft pages hosted on Google domains get trusted.
Take Action
See something suspicious in your inbox? Forward it to submit@blackdome.ai and let our detonation engine tear it apart. We'll analyze it, detonate any payloads, and feed the intelligence back into our detection models.
Building security tools? The BlackDome API gives you programmatic access to our threat intelligence, detonation capabilities, and real-time IOC feeds. Stop reinventing the wheel—plug into a system that's already tracking hundreds of thousands of threats per week.
Stay sharp. The threats aren't slowing down.