One SHA256 to Rule Them All
Let's lead with the thing that caught our eye this week. Among the 568 files detonated from honeypot captures, four separate detonation jobs — IDs 587bc74ff5d245f784f99758943a4ba9, dd47b124453841bba7d2ba58c43e2a3b, 376c72687dce40d89fccff5a31300cb1, and d1a78a758f3540b88528203809fe2598 — all resolved to the exact same payload:
SHA256: 1507487e8844f772be9f80ac9e3577b2b32c930e92909c0595cb68821caf6f2f
Four distinct delivery attempts, one shared binary. That's not coincidence — that's a campaign. A fifth notable detonation (ed2eb39416004710b9a5e0e5d1c4c064) flagged a separate payload at SHA256 a592eb6302c4b7de408c64bf8b5a9e8255beb0c9f2a737ec0981dd56f3bf9035, confirming at least two active malware families moving through our sensor grid this week. Block both hashes. Now.
Honeypot Activity: The Internet Is Still Feral
The global sensor network absorbed 2,441,609 events from 12,221 unique IPs across 20,126 sessions during the week of June 1–7, 2026. That's not background noise — that's coordinated, persistent, automated scanning at industrial scale.
SSH led the protocol abuse chart by a wide margin at 767,861 events, followed closely by SMB at 642,314 — a pairing that screams lateral movement tooling and brute-force credential stuffing. Telnet came in third at 468,639 events, a reminder that legacy protocol exposure is still very much a live threat surface. MySQL rounded out the top four at 315,187 events.
The top attacking IPs this week:
- 213.209.159.154 — 311,991 events. Dominant. This IP alone accounted for over 12% of total honeypot traffic.
- 196.188.116.56 — 148,053 events
- 144.0.23.165 — 77,105 events
- 167.172.151.207 — 54,800 events
- 41.33.255.138 — 54,037 events
If any of these IPs appear in your firewall logs, you have a problem that predates this report.
Credentials: 172,995 Pairs Walked Right In
Our honeypots captured 172,995 credential pairs this week. Let that number breathe for a second. Nearly 173,000 username/password combinations submitted by attackers probing for access.
- MySQL: 87,759 credential attempts — the single largest source, reflecting the sustained database-targeting trend
- SSH: 76,536 — automated brute-force tooling is alive and well
- PostgreSQL: 8,408 — database credential attacks are not slowing down
- FTP, HTTP, HTTPS, and SMTP rounded out the remainder at comparatively minor volumes
The MySQL/PostgreSQL split is worth watching. Database-direct attacks suggest actors looking for exfiltration paths, not just footholds.
File Detonations
Honeypot Captures
568 files pulled from honeypot sessions were detonated this week. The verdict breakdown is blunt:
- Malware: 499 (87.9%)
- Suspicious: 66 (11.6%)
- Exploit: 1
- Unknown: 2
Nearly 88% of everything our honeypots caught this week was confirmed malware. That's not a spike — that's the baseline for what's actively circulating on the internet right now.
Submissions
0 user submissions were received this week. No community-submitted files were processed during this period.
Reliability
Detonation infrastructure ran clean. 2 failed detonations out of 568 total, both due to timeout, for a failure rate of 0.35%. The LLM safe-override counter held at 0 — no cases where the model called something safe and policy had to step in. The pipeline is doing its job.
Email Analysis
A quieter week on the email front. 7 emails analyzed, all returning a safe verdict. No phishing, no credential theft, no malware delivery, no brand impersonation detected. Either the campaign operators took the week off or they're shifting delivery vectors — given the honeypot volume, we'd bet on the latter.
By The Numbers
- 2,441,609 total honeypot events
- 12,221 unique attacking IPs
- 20,126 sessions recorded
- 767,861 SSH events — top protocol
- 642,314 SMB events
- 172,995 credential pairs captured
- 87,759 MySQL credential attempts
- 568 files detonated from honeypot captures
- 499 confirmed malware verdicts (87.9% of detonations)
- 1 exploit-class payload detected
- 5 notable malware detonations across 2 distinct SHA256 hashes
- 0.35% detonation failure rate
- 7 emails analyzed, 7 safe
Stay in the Loop
If something suspicious lands in your inbox, don't sit on it. Forward it to submit@blackdome.ai and let the pipeline do the work. Every submission sharpens the detection surface for the entire community.
Want programmatic access to IOC feeds, detonation verdicts, and honeypot telemetry? The BlackDome API gives you real-time threat data you can actually operationalize. Hit up blackdome.ai to get started.