Nearly One Million Reasons to Pay Attention
Let's lead with the headline: our honeypot network absorbed 958,124 events from 9,778 unique IPs across 2,644 sessions in a single week. That's not background noise — that's a sustained, distributed assault against exposed services. And buried inside that traffic? 38,023 captured credential pairs, the overwhelming majority of them pulled over SSH. Attackers are not getting more creative. They're getting more relentless.
The Honeypot Picture: SSH and SMB Are Getting Hammered
Protocol breakdown tells a familiar but sobering story. SSH led the pack by a wide margin with 458,732 hits, followed by SMB at 330,558 — a reminder that legacy file-sharing exposure is still very much a thing in 2026. Telnet clocked in at 69,173 hits, which means someone out there still has Telnet open and someone else very much wants in.
Rounding out the top protocols: HTTP at 36,256, HTTPS at 20,354, PostgreSQL at 9,100, Redis at 7,418, and MySQL at 7,107. Database services getting probed at scale is a pattern worth watching — credential stuffing against exposed DB ports is a low-effort, high-reward play for threat actors.
Top Attacking IPs This Week
Five IPs stood out for sheer volume. Block these, share them, add them to your threat intel feeds:
- 120.48.45.201 — 136,405 events. This one is not scanning, it's hammering.
- 223.206.34.23 — 45,937 events
- 212.80.7.132 — 44,757 events
- 64.227.145.246 — 19,228 events
- 41.218.87.106 — 19,134 events
The top IP alone accounts for over 14% of all honeypot events this week. That's a dedicated operator or a very well-tuned botnet node.
Credential Capture Breakdown
Of the 38,023 credentials captured across all honeypot services, 36,757 came from SSH alone. The rest trickled in from MySQL (673), PostgreSQL (496), SMTP (37), FTP (32), HTTP (20), and HTTPS (8). The SSH dominance here is consistent with mass brute-force campaigns targeting cloud-exposed Linux instances. If you have port 22 open to the world without rate limiting and key-based auth enforcement, this data is about you.
Email Threat Landscape: Phishing Holds Steady
Out of 15 emails analyzed this week, 4 were confirmed phishing, 1 was spam, and 10 were clean. No malware attachments, no credential-theft payloads beyond the phishing lures themselves — but the phishing samples that did show up were aggressive.
Notable phishing subjects flagged at risk score 95:
- "Fwd: ⚠️Final Notice: Your photos and videos will be deleted - take action⚠️" — Classic urgency-and-fear lure. Emoji in the subject line is a social engineering tell at this point.
- "FW: Your Premium Access Has Ended" — Subscription expiry lure, likely harvesting payment or login credentials.
- "Fw: HIT Equipment International N73779757642P" — Business email compromise-style lure with a fake invoice reference number. This one is targeting organizations, not consumers.
No specific brands were confirmed impersonated this week, but the lure patterns — account termination, premium access loss, fake B2B invoices — are evergreen playbooks.
ThreatDrop: Phishing Infrastructure on Trusted Clouds
ThreatDrop detonated 4 URLs this week. All 4 came back hostile. All 4 were phishing. Zero malware distribution — but 100% hostility rate on detonated URLs is not a stat to gloss over.
What's notable is where this infrastructure lives. Of the 4 hostile URLs:
- 3 were hosted on Google LLC (GOOGLE, US)
- 1 was hosted on Amazon.com, Inc. (AMAZON-02, US)
Abuse reports were filed with both providers. As of publication, 0 confirmed takedowns. Phishing operators know that trusted cloud infrastructure adds legitimacy to their URLs and slows takedown timelines. This is a deliberate hosting strategy, not coincidence.
Malware Detonation Lab: Suspicious Files Dominate
The detonation pipeline processed 166 files this week. The verdict breakdown:
- 109 flagged suspicious
- 41 benign
- 10 needs review
- 5 failed
- 1 under manual review
That's a 65.7% suspicious rate on submitted files. Five notable detonations from this week's IOC set:
- SHA256: e3d794a4a3ea047ce75d00a145aa4d857f76bf8698c00631694d0e0337a160de (Detonation ID: 748ecd641bfa4c18948e96965966330b)
- SHA256: a609cfe92a32f1dec24416c2e866f6ce69acaf2a64de42bf1f901e68608bc791 (Detonation ID: 7439f8c9e78f438483deaf29622048cb)
- SHA256: 1507487e8844f772be9f80ac9e3577b2b32c930e92909c0595cb68821caf6f2f (Detonation IDs: 879510452082435da38d33be8cf7ec28, bd89ce6a04324ecfa9060275eb473299 — same hash, submitted twice)
- SHA256: af5c97c9e69708a70d9fbfc31eb1dc7674c0be00fa10b110d623545542d78e61 (Detonation ID: eeef3dea6278444c94c69c2f64bfb86d)
The repeated submission of hash 1507487e8844f772be9f80ac9e3577b2b32c930e92909c0595cb68821caf6f2f is worth noting — same file, two detonation runs, consistent suspicious verdict.
By The Numbers
- 958,124 total honeypot events
- 9,778 unique attacking IPs
- 38,023 credentials captured
- 36,757 of those via SSH
- 458,732 SSH honeypot hits
- 330,558 SMB honeypot hits
- 136,405 events from top attacking IP (120.48.45.201)
- 15 emails analyzed, 4 confirmed phishing
- 166 files detonated, 109 flagged suspicious
- 4 hostile URLs detonated — 100% phishing
- 3 phishing URLs hosted on Google infrastructure
- 0 confirmed takedowns from 4 abuse reports
Stay Sharp
If something lands in your inbox that smells wrong — forward it to submit@blackdome.ai. Our pipeline will detonate it, score it, and add it to the collective threat picture.
Need programmatic access to IOCs, verdicts, and honeypot intelligence? The BlackDome API gives you real-time feeds you can plug directly into your SIEM, firewall, or threat hunting workflow. Don't just read about the threat landscape — integrate it.