The Internet Is Still Trying to Break In
Let's cut straight to it. This week, BlackDome's global sensor network absorbed 3,354,568 honeypot events from 13,765 unique IPs across 93,797 sessions. That's not background noise — that's an organized, persistent, automated assault on exposed infrastructure happening right now, every hour, every day. If you have a device with a public IP and an open port, someone is already knocking.
The headline stat that should make every sysadmin sit up straight: our honeypots captured 169,039 credential pairs over the course of the week. The overwhelming majority — 163,048 — came in over SSH. Attackers are not guessing randomly; they're running optimized wordlists and credential-stuffing tools at scale. PostgreSQL contributed another 2,819 captured credentials, MySQL added 1,734, and FTP chipped in 1,153 more. Even SMTP and HTTPS saw credential spray activity. If you're running any of these services exposed to the internet without MFA or key-based auth, you are the target.
Protocol Breakdown: Telnet Is Not Dead (Unfortunately)
The top attack protocol this week was Telnet at 1,579,023 events — nearly half of all honeypot traffic. Yes, Telnet. In 2026. Botnet operators and IoT-targeting campaigns continue to hammer legacy protocols because legacy devices are still out there, still listening, still compromised. SSH followed at 961,257 events, SMB at 406,470, HTTP at 129,775, and PostgreSQL at 100,069. Redis rounded out the bottom of the top eight at 12,880 events — small number, high-value target.
Top Attacking IPs This Week
Five IPs stood out from the crowd this week, generating a disproportionate share of the noise:
- 194.50.16.36 — 139,196 events
- 95.214.54.54 — 137,757 events
- 68.178.164.8 — 86,399 events
- 200.89.69.247 — 79,768 events
- 213.209.159.115 — 47,785 events
Block these. Add them to your threat intel feeds. These aren't casual scanners — the top two alone generated over a quarter million hits combined in a single week.
File Detonations: Honeypot Captures
The BlackDome sandbox processed 900 files pulled directly from honeypot sessions this week. The verdict breakdown is not subtle:
- Malware: 757
- Suspicious: 142
- Unknown: 1
That's an 84.1% confirmed malware rate on files delivered by live attackers to our honeypots. These aren't edge cases — this is what attackers are actually dropping on systems they successfully touch. The suspicious category represents another 15.8% that didn't clear. Exactly one file came back unknown.
File Detonations: Submissions
No user submissions were processed this week. The detonation pipeline is open and ready — if you've got a file you want eyes on, send it through.
File Detonations: Reliability
Out of 904 total detonation attempts, there was 1 failed detonation — a single timeout — for a failure rate of 0.11%. The pipeline is running clean. Zero LLM safe-verdict overrides were triggered this week, meaning every automated analysis held up without policy intervention.
Notable IOCs
Five malware detonations this week are worth flagging explicitly for your threat intel pipelines. All were confirmed malware verdicts:
- SHA256: 0a8abd5751bfac39b2a42b4bb4e64f2c1f8b1de784bf656a701f5689f1a5d2c8 (Detonation ID: 3955fb19ccc44ab7981a697e3c7faef2)
- SHA256: 72561b01f748cf7d8805f262fdc578df3720021ff7a13f0b59a48ff1bce81e2a (Detonation ID: e0557a97fa2947cea2eeaf52e4fd9ab5)
- SHA256: 2e5761d4064aab02662ed87b4111f0c8e416637844504db1bd96a013411fed2e (Detonation ID: 1408f4c75f9a4fb69f607e64d4e72859)
- SHA256: 5dcca178ef615599ef3afea2ceb9132353337bf8d201235127e6a6fcf7f2a250 (Detonation ID: 24108f395e3a426491a275995edb98c9)
- SHA256: df25b61a0cbcb7854d599d2e4d070e565bd7c051c558cce3a02e672d81fc6aa1 (Detonation ID: 591fff84208b4956b81a4a1a1318a3fa)
Hash these against your EDR and SIEM logs. If you're seeing any of these, you have a problem that needs immediate attention.
Email Analysis
This week's email pipeline processed 22 messages, all returning safe verdicts. No phishing, no credential theft, no malware, no spam. No impersonated brands or lure families to report. Clean week on the inbox front — enjoy it, because it won't last.
By The Numbers
- 3,354,568 total honeypot events
- 13,765 unique attacking IPs
- 93,797 honeypot sessions
- 169,039 credentials captured
- 163,048 of those over SSH alone
- 1,579,023 Telnet attack events (top protocol)
- 900 honeypot files detonated; 757 confirmed malware
- 84.1% malware rate on honeypot-sourced files
- 0.11% detonation failure rate (1 timeout in 904 attempts)
- 22 emails analyzed; 22 safe
- 5 notable malware IOCs published this week
Stay Sharp
If something's landed in your inbox and it doesn't feel right, don't sit on it. Forward it to submit@blackdome.ai and let the pipeline do the work. Need programmatic access to verdicts, IOC feeds, and detonation results? The BlackDome API gives you direct integration into your SIEM, SOAR, or threat intel platform. The data is here — use it.