The Credential Gold Rush Continues
This week, our honeypots captured 1,037 credentials across SSH, PostgreSQL, FTP, and MySQL—a reminder that attackers are still banking on weak passwords and default configurations. SSH led the pack with 684 captured credentials, followed by PostgreSQL at 149. If you're still running default creds on internet-facing services, you're basically handing out keys to the kingdom.
Email Threats: Small Volume, High Impact
We analyzed 24 emails this week, and while the volume was modest, the threat density was notable. 10 malicious emails made it through: 5 malware, 4 credential theft, and 1 phishing attempt. That's a 42% malicious rate—well above baseline.
The standout? Two credential theft campaigns impersonating krystalunity.com with risk scores of 78. Both used Google-themed lures with subject lines mimicking domain abuse reports. Attackers are getting creative, leveraging the trust associated with brand protection notifications to steal credentials.
Other notable lures included:
- Payroll-themed malware: "Your Approval is Needed to Process your Direct Deposit"
- Financial services impersonation: Fidelity Investment account updates
- Callback scams: Free window breakers and seatbelt cutters (yes, really)
Lure families were diverse: newsletter, callback scam, payroll, and generic other tactics all made appearances. Attackers are testing multiple vectors to see what sticks.
Honeypot Highlights: 210K Events, 5,370 Unique IPs
Our honeypot infrastructure logged 209,958 events from 5,370 unique IP addresses across 18,207 sessions. The threat landscape remains heavily focused on SSH and SMB exploitation:
- SSH: 95,627 events (45.5%)
- SMB: 67,355 events (32.1%)
- HTTP: 16,672 events
- Telnet: 14,054 events
- PostgreSQL: 3,276 events
Geographically, Singapore led the charge with 29,663 events, followed by France (15,834) and the US (8,325). A significant portion (17,223 events) came from unknown or anonymized sources—VPNs, proxies, and Tor exits doing their thing.
Top Attacking IPs
Five IPs accounted for a disproportionate share of activity:
- 167.99.72.161: 18,356 events
- 207.180.211.173: 15,828 events
- 54.82.2.151: 15,002 events
- 165.22.54.16: 11,304 events
- 103.83.11.138: 8,141 events
These IPs are worth adding to your blocklists. They're persistent, aggressive, and clearly part of larger scanning or exploitation campaigns.
Malware Detonations: Suspicious Activity Detected
We detonated 14 files this week in our sandbox environment. Most (11) required manual review, 2 timed out, and 1 returned a suspicious verdict. The suspicious sample (SHA256: live_test_5130a0e63ad54cabb2f201f8d796b00c) exhibited behavior consistent with reconnaissance or persistence mechanisms.
No URLs were detonated this week, and ThreatDrop recorded zero abuse reports or takedowns—a quieter week on the infrastructure disruption front.
By The Numbers
- Total honeypot events: 209,958
- Unique attacking IPs: 5,370
- Credentials captured: 1,037
- Emails analyzed: 24
- Malicious emails: 10 (42% malicious rate)
- Malware samples detonated: 14
- Top protocol: SSH (95,627 events)
- Top source country: Singapore (29,663 events)
- Top impersonated brand: krystalunity.com (50% of brand impersonations)
- Highest risk score: 78 (credential theft campaigns)
What This Means for You
The threat landscape remains relentless. SSH and SMB continue to be the protocols of choice for attackers, and credential-based attacks show no signs of slowing. Email threats are evolving with more sophisticated social engineering—impersonating domain abuse reports and financial institutions to bypass user skepticism.
If you're not monitoring for credential stuffing, brute force attempts, and brand impersonation, you're flying blind. The data doesn't lie: attackers are persistent, automated, and increasingly creative.
Stay Ahead of the Threats
Got a suspicious email? Forward it to submit@blackdome.ai and let our analysis engine tear it apart. Want to integrate real-time threat intelligence into your security stack? Check out the BlackDome API for programmatic access to our threat data, detonation verdicts, and IOC feeds.
Stay sharp. Stay skeptical. And never trust an email about free window breakers.