The Lead: Credential Theft Dressed Up as a Magic Link
This week's most alarming email find wasn't a spray-and-pray phishing blast — it was a surgical credential-theft attempt with a risk score of 95/100. The lure? A message with the subject line "Your HaltState magic link" — clean, plausible, exactly the kind of single-use authentication email that busy users click without thinking. The goal was credential harvesting, and the delivery was polished enough to fool casual inspection. This is the threat vector defenders keep underestimating: low volume, high precision, high damage potential.
Close behind it was a classic deposit-lure phishing email — subject "FW: May 2026 in the post tomorrow, 'Deposit:05242899'" — scoring 85/100. Invoice and payment lures remain evergreen because they work.
Email Threat Landscape
BlackDome analyzed 23 emails this week. The breakdown:
- Safe: 19
- Phishing: 3
- Credential theft: 1
- Spam: 0
- Malware: 0
Top lure families observed were "other" (10) and invoice (1). No specific brands were impersonated this week in tracked detections, but the HaltState magic-link abuse is a reminder that attackers don't always need a recognizable logo — a convincing transactional format is enough.
Honeypot Intelligence: One Million Events and Counting
The BlackDome global honeypot grid absorbed 1,003,248 events this week across 15,566 unique IPs and 11,523 sessions. That's not background noise — that's an active, distributed scanning and exploitation ecosystem hammering exposed services around the clock.
Top attacked protocols:
- Telnet: 271,174 hits — IoT and legacy device hunters are relentless
- DNS: 232,203 — amplification and tunneling probes
- SSH: 220,136 — brute-force credential stuffing, as always
- SMB: 205,622 — lateral movement pre-positioning attempts
- HTTP/HTTPS: 28,643 / 10,722
- MySQL: 9,559 | Redis: 6,888 — database exposure hunting
Top attacking IPs this week (block these):
- 120.48.45.201 — 64,721 events, the week's most aggressive single source
- 37.156.35.91 — 30,415 events
- 212.103.37.222 — 29,737 events
- 47.117.148.169 — 17,612 events
- 181.49.161.173 — 15,531 events
If any of these IPs appear in your logs, treat them as hostile without further deliberation.
Credential Capture: 25,721 Pairs Logged
The honeypot grid captured 25,721 credential pairs this week. SSH dominated the haul at 23,371, confirming that exposed SSH is still the internet's most popular punching bag. PostgreSQL came in second at 1,340, MySQL at 925, with FTP, SMTP, HTTP, and HTTPS rounding out the rest. If your database or remote-access services are internet-facing without strict allowlisting, you are feeding these numbers.
File Detonations
Honeypot Captures
BlackDome detonated 143 files pulled directly from honeypot captures. Verdicts:
- Malware: 125
- Suspicious: 14
- Unknown: 4
That's an 87.4% confirmed malware rate from files attackers are actively dropping on exposed systems. This is not theoretical risk.
Submissions
2 user-submitted files were detonated this week. Both returned suspicious verdicts. Neither cleared. If you submitted one of these — it's not clean.
Reliability
198 total detonations. Zero failures. 100% reliability. The LLM override counter sits at 0 — no cases this week where the model called something safe and policy had to step in to correct it. Clean run.
ThreatDrop: URL Detonation & Abuse Reporting
ThreatDrop processed 1 URL detonation this week, flagging 1 hostile URL classified as credential theft. The hostile infrastructure was hosted on AMAZON-02 (Amazon.com, Inc., US) — a reminder that cloud-hosted malicious content remains a persistent problem precisely because legitimate provider reputation provides cover.
1 abuse report was filed. 0 confirmed takedowns as of publication. The fight to get cloud providers to act quickly is ongoing.
By The Numbers
- 1,003,248 honeypot events recorded
- 15,566 unique attacking IPs observed
- 25,721 credential pairs captured
- 23 emails analyzed; 4 threats detected
- 198 file detonations; 0 failures
- 125 honeypot-sourced files confirmed malware
- 1 hostile URL detonated via ThreatDrop (credential theft)
- 95/100 risk score on the week's top email threat
- 64,721 events from a single IP (120.48.45.201) — this week's most aggressive actor
Stay Sharp
If something landed in your inbox and your gut says it's wrong, trust that instinct. Forward suspicious emails to submit@blackdome.ai — our analysts and detonation pipeline will take it from there.
Want programmatic access to IOC feeds, detonation results, and threat scoring? The BlackDome API gives your security stack direct access to the same intelligence powering this report. Reach out to get integrated.