One IP. 647,000 Hits. Let That Sink In.
This week's most striking data point isn't a novel malware family or a zero-day — it's raw, relentless volume. A single IP address, 113.128.205.16, hammered our honeypot infrastructure with 647,119 events out of a total 1,662,224 recorded this week. That's nearly 39% of all honeypot traffic originating from one source. Whether that's a misconfigured scanner, a dedicated brute-force node, or something more deliberate, it belongs on your block list right now.
The runner-up, 120.48.45.201, added another 114,383 hits, followed by 118.194.239.74 (40,859), 103.192.199.168 (40,639), and 172.83.83.85 (33,301). The top five alone account for over half the week's total honeypot volume. This is not background noise — this is sustained, targeted scanning.
Honeypot & Network Activity
Across 12,423 unique IPs and 5,579 sessions, attackers kept hammering the usual entry points:
- SSH dominated with 1,043,997 events — credential stuffers never sleep
- SMB came in second at 358,828 hits — lateral movement prep is alive and well
- Telnet clocked 147,007 events — yes, Telnet, in 2026
- HTTP/HTTPS combined for 60,139 events
- PostgreSQL saw 12,388 probes, SMTP 6,957, and MongoDB 6,806
On the credential side, 170,369 credential pairs were captured across the week. SSH accounted for 166,092 of those — nearly 97.5% of all captured credentials. PostgreSQL contributed 2,950 and MySQL 1,118. Attackers are not getting creative; they're getting persistent.
Email Threats: McAfee Impersonation Leads the Pack
Of 28 emails analyzed this week, 15 were malicious or suspicious — 13 phishing, 2 malware, and 2 spam. Only 11 cleared as safe.
McAfee was the most abused brand, appearing in 3 impersonation campaigns (42.9%) of branded lures. The irony of a security vendor being weaponized to deliver threats is not lost on us. Google, Liverpool, BancoEstado, and Guns.com each appeared once, rounding out a geographically and vertically diverse target set — Swedish-language security alerts, Spanish-language retail promotions, and Chilean banking lures all showed up in the same week's haul.
Top lure families this week:
- Invoice lures: 4 — classic business email compromise bait
- Callback scams: 2 — the "call us to cancel your subscription" grift
- Account recovery: 2 — fake security alerts designed to harvest credentials
Notable high-risk subjects flagged this week (risk scores in parentheses):
- Amazon Web Services: You have submitted a new report [54175122667] — malware, score 95 — AWS brand abuse carrying a malicious payload
- Fw: order desk — phishing, score 95
- Fwd: Cartola de CuentaRUT — phishing, score 95 — BancoEstado lure targeting Chilean banking customers
- Fwd: Kritisk säkerhetsvarning — phishing, score 95 — Swedish-language Google account recovery lure
- Fw: MOI4295415514CIRO HIT Equipment International — phishing, score 95 — invoice-style lure with obfuscated reference numbers
File Detonation: Honeypot Captures
187 files captured from honeypot sessions were detonated this week. The verdict breakdown is not pretty:
- Malware: 176
- Suspicious: 4
- Unknown: 7
That's a 94.1% confirmed malware rate on honeypot-origin files. Whatever is knocking on those ports is not coming to say hello.
File Detonation: Submissions
0 user submissions were processed this week. If you've got something suspicious sitting in your quarantine folder, now's a good time to send it our way.
File Detonation: Reliability
232 total detonations completed with zero failures — a 100% reliability rate. The LLM override counter sits at 0, meaning no hostile-origin samples slipped through with a false-safe verdict. The pipeline is clean.
ThreatDrop URL Intelligence
ThreatDrop processed 4 URL detonations this week — all 4 confirmed phishing, zero malware distribution URLs. Abuse reports were filed with 2 hosting providers:
- AMAZON-02 (Amazon.com, Inc., US): 2 malicious URLs hosted
- DIGITALOCEAN-ASN (DigitalOcean, LLC, US): 2 malicious URLs hosted
4 abuse reports sent. 0 confirmed takedowns. The hosting providers have been notified. The clock is ticking.
By The Numbers
- 1,662,224 total honeypot events
- 12,423 unique attacking IPs
- 647,119 events from a single IP (113.128.205.16)
- 170,369 credential pairs captured
- 28 emails analyzed; 13 phishing, 2 malware
- McAfee impersonated in 42.9% of branded lure emails
- 232 file detonations at 100% reliability
- 176 of 187 honeypot-origin files confirmed malware (94.1%)
- 4 phishing URLs detonated; 4 abuse reports filed; 0 takedowns
Stay Sharp
Suspicious email land in your inbox this week? Don't let it sit. Forward it to submit@blackdome.ai and let the pipeline do the work. If you're building detection or enrichment workflows, the BlackDome API gives you programmatic access to verdicts, IOCs, and threat intelligence feeds. Integrate once, stay informed continuously.