SMB: Still the Attacker's Favorite Protocol
This week, our honeypots recorded 638,502 events from 8,781 unique IPs across 10,758 sessions. The standout? SMB led the charge with 299,003 attempts—nearly 47% of all traffic. Attackers continue to hammer legacy Windows protocols, proving that old vulnerabilities never really die.
SSH came in second with 222,862 attempts, followed by Telnet at 40,717. If you're still running Telnet in 2026, we need to talk. HTTP and HTTPS combined for another 40,389 events, while database protocols like PostgreSQL, Redis, and MongoDB rounded out the top eight.
Credential Harvesting at Scale
Our honeypots captured 19,180 credential pairs this week. SSH dominated the haul with 18,423 username/password combos—attackers are relentlessly brute-forcing SSH endpoints. PostgreSQL contributed 393 credentials, MySQL added 329, and FTP scraped together 29.
These aren't sophisticated attacks. They're volume plays. Attackers are spraying common credentials across the internet, hoping something sticks. If you're using default passwords or weak credentials on SSH, you're already compromised.
Top Attacking IPs and Source Countries
Five IPs accounted for a disproportionate share of hostile activity:
- 41.33.255.138 – 35,732 events
- 103.235.215.74 – 35,450 events
- 120.48.45.201 – 29,027 events
- 190.56.123.185 – 17,676 events
- 167.86.80.118 – 15,851 events
By country, Germany led with 16,237 events, followed by Singapore (7,832), Netherlands (6,209), and China (2,482). These aren't necessarily the attackers' home countries—just where they're routing traffic through compromised infrastructure or VPS providers.
Phishing: Targeting Spanish and Portuguese Speakers
We analyzed 15 emails this week, catching 4 phishing attempts. Two campaigns stood out:
- La Economía and CorrLinks were the top impersonated brands, each representing 50% of brand abuse.
- Phishing lures included fake purchase confirmations ("¡Gracias por tu compra!") and bogus custody notifications targeting CorrLinks users.
- One suspicious email with an 80 risk score posed as a pre-approved credit card offer in Portuguese.
Attackers are clearly targeting Spanish and Portuguese-speaking users with localized social engineering. If your organization operates in Latin America or has Portuguese-speaking employees, stay sharp.
Malware Detonations: Suspicious Files Everywhere
Our sandbox detonated 108 files this week. The breakdown:
- 64 flagged for review
- 27 marked suspicious
- 14 need further review
- 2 failed to detonate
- 1 unknown
Five notable suspicious samples surfaced, including:
- a609cfe92a32f1dec24416c2e866f6ce69acaf2a64de42bf1f901e68608bc791 (appeared twice)
- e3d794a4a3ea047ce75d00a145aa4d857f76bf8698c00631694d0e0337a160de (appeared twice)
- c360e269456fcddac08e0a8436e9a96a749f0cf1467f6b9503a694b2e6594663
These samples exhibited suspicious behavior but didn't trigger definitive malware signatures. They're likely polymorphic loaders, droppers, or obfuscated payloads designed to evade static analysis.
Edge Node Activity
Our distributed edge nodes processed 1,887 events across six locations. London (blkdm-lon-01) led with 674 events, followed by New York (329), Toronto (317), Bangalore (247), Helsinki (216), and Sydney (104).
London's dominance suggests European infrastructure remains a prime target for reconnaissance and exploitation attempts.
By The Numbers
- 638,502 total honeypot events
- 8,781 unique attacking IPs
- 19,180 stolen credentials captured
- 299,003 SMB connection attempts
- 222,862 SSH brute-force attempts
- 108 files detonated in sandbox
- 27 files flagged as suspicious
- 4 phishing emails detected
- 15 total emails analyzed
- 10,758 honeypot sessions
What This Means
Attackers are still winning with the basics: default credentials, unpatched SMB, and localized phishing. The threat landscape hasn't gotten more sophisticated—it's gotten more persistent. Volume beats complexity when defenders leave the door open.
If you're not monitoring SSH brute-force attempts, hardening SMB, or training employees to spot localized phishing, you're giving attackers exactly what they want.
Stay Protected
Forward suspicious emails to submit@blackdome.ai for analysis. Want to integrate threat intelligence into your security stack? Check out the BlackDome API for real-time threat data, IOC feeds, and automated analysis.
Stay paranoid. Stay protected.