The Internet Is Still Trying to Kick Your Door In
Let's lead with the number that matters most this week: 178,188 credentials captured across our global honeypot network in a single seven-day window. That's not a typo. Automated scanners and credential-stuffing bots are hammering exposed services around the clock, and the volume shows no sign of letting up. If you have MySQL or SSH exposed to the internet without strict access controls, you are actively being tested right now.
This week's data paints a picture of relentless, opportunistic mass-scanning — low sophistication, high volume, and brutally effective against anyone who hasn't locked down the basics.
Honeypot Intelligence: 1.5 Million Events and Counting
Our distributed honeypot grid logged 1,502,866 total events this week, generated by 9,882 unique source IPs across 17,351 sessions. That's a significant scan footprint, and the protocol breakdown tells you exactly what attackers are after.
Telnet led the pack by a wide margin — 558,656 events — a reminder that legacy IoT and embedded device exploitation is alive, well, and automated. SSH came in second at 486,805 events, followed by SMB at 270,279. HTTP rounded out the top four at 103,349 events.
The top attacking IPs this week:
- 104.244.74.201 — 47,680 events
- 127.0.0.1 — 44,995 events (loopback traffic flagged internally; worth noting)
- 152.42.247.85 — 39,544 events
- 190.145.177.155 — 35,765 events
- 202.169.44.105 — 27,980 events
Block these. Add them to your deny lists. They're not doing anything subtle.
Credential Captures: MySQL and SSH Are the Big Targets
Of the 178,188 credential pairs harvested across honeypot services this week, the breakdown by protocol is telling:
- MySQL: 89,724 — attackers are hunting for exposed database servers with default or weak credentials
- SSH: 83,151 — brute-force campaigns against remote access remain the bread and butter of opportunistic threat actors
- PostgreSQL: 3,498
- FTP: 1,694
- HTTP, HTTPS, and SMTP combined for fewer than 125 captures
The MySQL and SSH numbers together account for over 96% of all credential activity this week. If your database or SSH daemon is internet-facing with anything less than key-based auth and an allowlist, you're a statistic waiting to happen.
File Detonations
Honeypot Captures
BlackDome's sandbox detonated 480 files pulled directly from honeypot sessions this week. The verdict breakdown is stark:
- Malware: 417 (86.9%)
- Suspicious: 62 (12.9%)
- Unknown: 1 (0.2%)
Nearly nine out of every ten files dropped by attackers into our honeypots were confirmed malware. Two distinct SHA256 hashes appeared repeatedly across multiple detonation events, suggesting coordinated deployment of the same payloads:
- SHA256: 1507487e8844f772be9f80ac9e3577b2b32c930e92909c0595cb68821caf6f2f — confirmed malware, seen across detonation IDs c7ddaf6cb55f437595439e71e18e7ede, 2485e633faf843d49700fe08691c2257, and 0205d548b12647d09ff501568d6d3dc1
- SHA256: d59e0f98fe48927e0846b4e0550c4a05d3de6fb3de4035e18e1756fcb66c747d — verdict suspicious, seen in detonation IDs 02f838da5b6149c5830b0c7f9fffaad5 and 5abdf8238714460394ca9259832f8930
The repeat appearance of the same hashes across independent sessions is a strong indicator of scripted, automated payload delivery — not a human operator manually dropping files.
Submissions
No user-submitted files were processed this week. Zero submissions, zero verdicts.
Reliability
The detonation pipeline ran clean: 480 detonations, 0 failures, for a 100% reliability rate. LLM safe-verdict overrides by policy: 0. The system is working exactly as designed.
Email Analysis: A Quiet Week in the Inbox
BlackDome analyzed 19 emails this week. All 19 came back clean — 0 phishing, 0 credential theft, 0 malware, 0 spam. No impersonated brands, no active lure families detected. Enjoy the quiet. It won't last.
Edge Node Activity
Sessions distributed across the global edge fleet, with Bangalore leading this week:
- blkdm-blr-02: 7,554 sessions
- blkdm-lon-02: 5,381
- leeroy-syd-01: 4,444
- blkdm-nyc-02: 4,228
- blkdm-tor-02: 2,640
- blkdm-hel-01: 1,738
By The Numbers
- 1,502,866 total honeypot events
- 9,882 unique attacking IPs
- 17,351 honeypot sessions
- 178,188 credentials captured
- 89,724 MySQL credential attempts (top protocol)
- 83,151 SSH credential attempts
- 558,656 Telnet events (top honeypot protocol)
- 480 files detonated from honeypot captures
- 417 confirmed malware (86.9% of detonations)
- 62 suspicious verdicts
- 100% detonation pipeline reliability
- 19 emails analyzed, 0 threats detected
Stay Sharp
The internet doesn't take weeks off. If something lands in your inbox that feels off — a weird attachment, an unexpected invoice, a login alert from a service you barely use — forward it to submit@blackdome.ai. Our analysts and sandbox will tell you exactly what it is.
Want programmatic access to this intelligence? The BlackDome API gives you real-time threat verdicts, IOC feeds, and detonation results you can pipe directly into your SIEM, SOAR, or threat intel platform. Check the docs and start a trial at blackdome.ai.