The Internet Is Still a Dumpster Fire
This week, BlackDome sensors recorded 870,270 hostile events from 14,366 unique IPs across 15,522 sessions. If you thought legacy protocols were dead, think again: telnet alone accounted for 406,769 events—nearly half of all traffic. Attackers are still hammering ancient services because they work, and because too many organizations still expose them.
Our honeypot fleet pulled in 118 malware samples, with 106 confirmed malicious and 11 flagged suspicious. That's an 89.8% malware rate on captured files. The internet isn't just noisy—it's actively hostile.
Telnet, SSH, and SMB: The Unholy Trinity
The protocol breakdown tells a familiar but grim story:
- Telnet: 406,769 events (46.7%)
- SSH: 200,539 events (23.0%)
- SMB: 180,168 events (20.7%)
- HTTP: 34,008 events
- HTTPS: 10,144 events
Telnet remains the king of brute-force attacks, followed closely by SSH. If you're still running telnet in production, we need to talk. Attackers captured 32,992 credentials this week, with 31,554 yanked via SSH alone. PostgreSQL (804), MySQL (568), and FTP (54) rounded out the credential theft leaderboard.
Top Attacking IPs
Five IPs were responsible for a disproportionate share of the noise:
- 83.118.66.154: 37,915 events
- 120.48.45.201: 19,099 events
- 188.138.29.183: 18,771 events
- 103.179.13.189: 17,697 events
- 47.77.182.54: 14,537 events
These IPs hammered our honeypots relentlessly, probing for weak credentials and exploitable services. Block them. Feed them to your firewall. Make them someone else's problem.
File Detonations: Honeypot Captures
Our sandbox processed 118 files captured from honeypot interactions:
- Malware: 106 samples
- Suspicious: 11 samples
- Unknown: 1 sample
Notable hashes flagged this week include:
a6713518f2e26745683d33ded61b465d0645d7af850464c559fba8bb84e68398(malware)1507487e8844f772be9f80ac9e3577b2b32c930e92909c0595cb68821caf6f2f(malware)794846abbea20e47f4dd643c82fdc9548aaa687120e87e6886579f5d5b1745ef(malware)c21fe8daf2be6fb3bc8f5e6eda039159b4b3c375d93335c39069a1c92cfa29b6(suspicious, seen twice)
These samples were dropped via compromised services or delivered through automated exploit chains. The malware rate remains disturbingly high.
File Detonations: Submissions
We received zero user submissions this week. If you're sitting on suspicious files or emails, send them our way. We detonate, analyze, and share the intel.
File Detonations: Reliability
Our sandbox maintained a 99.19% success rate, with just 1 timeout out of 123 detonations (0.81% failure rate). No LLM overrides were triggered this week—when our models called something safe, it stayed safe.
Email Threats: Quiet but Present
Email analysis was light this week: 14 messages analyzed, with 11 safe, 1 phishing attempt, and 2 malware-laden emails. No major brand impersonation campaigns surfaced, and lure families were mostly generic. The phishing attempt and malware emails were caught and neutralized before they could do damage.
Edge Node Activity
Our global edge nodes processed threats across six locations:
- blkdm-lon-01 (London): 7,707 events
- blkdm-tor-01 (Toronto): 7,108 events
- blkdm-blr-01 (Bangalore): 4,726 events
- blkdm-nyc-01 (New York): 3,077 events
- leeroy-syd-01 (Sydney): 1,131 events
- blkdm-hel-01 (Helsinki): 842 events
London and Toronto bore the brunt of hostile traffic, but every node saw sustained attack activity.
By The Numbers
- 870,270 total hostile events
- 14,366 unique attacking IPs
- 15,522 attack sessions
- 406,769 telnet events (46.7% of all traffic)
- 32,992 credentials captured
- 118 malware samples detonated from honeypots
- 106 confirmed malicious files (89.8% malware rate)
- 14 emails analyzed (1 phishing, 2 malware)
- 99.19% sandbox success rate
What This Means
The threat landscape remains relentless. Attackers are still exploiting legacy protocols, brute-forcing credentials at scale, and dropping malware on anything that responds. If your perimeter includes telnet, unpatched SSH, or exposed SMB, you're a target.
The good news? Detection works. Honeypots work. Sandboxing works. You just have to deploy them.
Forward Suspicious Emails
See something sketchy in your inbox? Forward it to submit@blackdome.ai and we'll detonate, analyze, and report back. Want to integrate threat intel into your stack? Check out the BlackDome API for real-time threat data, malware verdicts, and IOC feeds.
Stay sharp. The internet isn't getting any safer.