Elektrine
Log in Register

#honeypot

65 posts · Last used 18h

Back to Timeline
rdpsnitch
RDP Snitch @rdpsnitch@infosec.exchange · 18h ago
2026-07-25 RDP #Honeypot IOCs - 2232 scans Thread with top 3 features in each category and links to the full dataset #DFIR #InfoSec Top IPs: 5.44.100.245 - 2124 35.203.211.119 - 12 134.209.62.30 - 12 Top ASNs: AS8648 - 2124 AS396982 - 30 AS14061 - 15 Top Accounts: hello - 2142 60wcz1bp - 12 Administr - 9 Top ISPs: Alvotech GmbH via velia.net - 2124 Google LLC - 30 DigitalOcean, LLC - 15 Top Clients: Unknown - 2232 Top Software: Unknown - 2232 Top Keyboards: Unknown - 2232 Top IP Classification: Unknown - 2151 hosting - 66 mobile & hosting - 12 Pastebin links with full 24-hr RDP Honeypot IOC Lists: Bad API request, invalid api_dev_key #CyberSec #SOC #Blueteam #SecOps #Security
0
0
0
rdpsnitch
RDP Snitch @rdpsnitch@infosec.exchange · 18h ago
2026-07-25 RDP #Honeypot IOCs - 1488 scans Thread with top 3 features in each category and links to the full dataset #DFIR #InfoSec Top IPs: 5.44.100.245 - 1416 35.203.211.119 - 8 134.209.62.30 - 8 Top ASNs: AS8648 - 1416 AS396982 - 20 AS14061 - 10 Top Accounts: hello - 1428 60wcz1bp - 8 Administr - 6 Top ISPs: Alvotech GmbH via velia.net - 1416 Google LLC - 20 DigitalOcean, LLC - 10 Top Clients: Unknown - 1488 Top Software: Unknown - 1488 Top Keyboards: Unknown - 1488 Top IP Classification: Unknown - 1434 hosting - 44 mobile & hosting - 8 Pastebin links with full 24-hr RDP Honeypot IOC Lists: Bad API request, invalid api_dev_key #CyberSec #SOC #Blueteam #SecOps #Security
0
0
0
rdpsnitch
RDP Snitch @rdpsnitch@infosec.exchange · 18h ago
2026-07-25 RDP #Honeypot IOCs - 744 scans Thread with top 3 features in each category and links to the full dataset #DFIR #InfoSec Top IPs: 5.44.100.245 - 708 35.203.211.119 - 4 134.209.62.30 - 4 Top ASNs: AS8648 - 708 AS396982 - 10 AS14061 - 5 Top Accounts: hello - 714 60wcz1bp - 4 Administr - 3 Top ISPs: Alvotech GmbH via velia.net - 708 Google LLC - 10 DigitalOcean, LLC - 5 Top Clients: Unknown - 744 Top Software: Unknown - 744 Top Keyboards: Unknown - 744 Top IP Classification: Unknown - 717 hosting - 22 mobile & hosting - 4 Pastebin links with full 24-hr RDP Honeypot IOC Lists: Bad API request, invalid api_dev_key #CyberSec #SOC #Blueteam #SecOps #Security
0
0
0
rdpsnitch
RDP Snitch @rdpsnitch@infosec.exchange · 1d ago
2026-07-24 RDP #Honeypot IOCs - 120 scans Thread with top 3 features in each category and links to the full dataset #DFIR #InfoSec Top IPs: 139.59.230.134 - 30 205.210.31.130 - 9 45.227.254.132 - 9 Top ASNs: AS14061 - 30 AS396982 - 27 AS267784 - 9 Top Accounts: hello - 33 Administr - 12 (empty) - 9 Top ISPs: DIGITALOCEAN - 30 Google LLC - 27 Flyservers S.A. - 9 Top Clients: Unknown - 120 Top Software: Unknown - 120 Top Keyboards: Unknown - 120 Top IP Classification: hosting - 75 Unknown - 36 proxy - 6 Pastebin links with full 24-hr RDP Honeypot IOC Lists: Bad API request, invalid api_dev_key #CyberSec #SOC #Blueteam #SecOps #Security
0
0
0
rdpsnitch
RDP Snitch @rdpsnitch@infosec.exchange · 1d ago
2026-07-24 RDP #Honeypot IOCs - 80 scans Thread with top 3 features in each category and links to the full dataset #DFIR #InfoSec Top IPs: 139.59.230.134 - 20 205.210.31.130 - 6 45.227.254.132 - 6 Top ASNs: AS14061 - 20 AS396982 - 18 AS267784 - 6 Top Accounts: hello - 22 Administr - 8 (empty) - 6 Top ISPs: DIGITALOCEAN - 20 Google LLC - 18 Flyservers S.A. - 6 Top Clients: Unknown - 80 Top Software: Unknown - 80 Top Keyboards: Unknown - 80 Top IP Classification: hosting - 50 Unknown - 24 proxy - 4 Pastebin links with full 24-hr RDP Honeypot IOC Lists: Bad API request, invalid api_dev_key #CyberSec #SOC #Blueteam #SecOps #Security
0
0
0
rdpsnitch
RDP Snitch @rdpsnitch@infosec.exchange · 1d ago
2026-07-24 RDP #Honeypot IOCs - 40 scans Thread with top 3 features in each category and links to the full dataset #DFIR #InfoSec Top IPs: 139.59.230.134 - 10 205.210.31.130 - 3 45.227.254.132 - 3 Top ASNs: AS14061 - 10 AS396982 - 9 AS267784 - 3 Top Accounts: hello - 11 Administr - 4 (empty) - 3 Top ISPs: DIGITALOCEAN - 10 Google LLC - 9 Flyservers S.A. - 3 Top Clients: Unknown - 40 Top Software: Unknown - 40 Top Keyboards: Unknown - 40 Top IP Classification: hosting - 25 Unknown - 12 proxy - 2 Pastebin links with full 24-hr RDP Honeypot IOC Lists: Bad API request, invalid api_dev_key #CyberSec #SOC #Blueteam #SecOps #Security
0
0
0
niclas
Niclas @niclas@infosec.exchange · 1d ago
Since March 2026, I have been running honeypots on the internet to collect data and analyze attack patterns. The amount of data stored in the log database has steadily increased over the past few months and has now reached 70 GB of raw logs. I may need to consider a better archiving strategy, especially since I am thinking about adding a T-Pot instance, which would significantly increase the load on the current database setup. #honeypot #postgresql #sysadmin #cybersecurity #blueteam
0
0
0
rdpsnitch
RDP Snitch @rdpsnitch@infosec.exchange · 2d ago
2026-07-23 RDP #Honeypot IOCs - 6951 scans Thread with top 3 features in each category and links to the full dataset #DFIR #InfoSec Top IPs: 173.225.102.23 - 6795 139.59.230.134 - 30 216.226.76.30 - 30 Top ASNs: AS19318 - 6795 AS396982 - 36 AS14061 - 30 Top Accounts: hello - 6825 root - 18 Administr - 15 Top ISPs: Interserver, Inc - 6795 Google LLC - 36 DIGITALOCEAN - 30 Top Clients: Unknown - 6951 Top Software: Unknown - 6951 Top Keyboards: Unknown - 6951 Top IP Classification: hosting - 6870 Unknown - 78 hosting & proxy - 3 Pastebin links with full 24-hr RDP Honeypot IOC Lists: Bad API request, invalid api_dev_key #CyberSec #SOC #Blueteam #SecOps #Security
0
0
0
rdpsnitch
RDP Snitch @rdpsnitch@infosec.exchange · 2d ago
2026-07-23 RDP #Honeypot IOCs - 2317 scans Thread with top 3 features in each category and links to the full dataset #DFIR #InfoSec Top IPs: 173.225.102.23 - 2265 139.59.230.134 - 10 216.226.76.30 - 10 Top ASNs: AS19318 - 2265 AS396982 - 12 AS14061 - 10 Top Accounts: hello - 2275 root - 6 Administr - 5 Top ISPs: Interserver, Inc - 2265 Google LLC - 12 DIGITALOCEAN - 10 Top Clients: Unknown - 2317 Top Software: Unknown - 2317 Top Keyboards: Unknown - 2317 Top IP Classification: hosting - 2290 Unknown - 26 hosting & proxy - 1 Pastebin links with full 24-hr RDP Honeypot IOC Lists: Bad API request, invalid api_dev_key #CyberSec #SOC #Blueteam #SecOps #Security
0
0
0
rdpsnitch
RDP Snitch @rdpsnitch@infosec.exchange · 3d ago
2026-07-22 RDP #Honeypot IOCs - 708 scans Thread with top 3 features in each category and links to the full dataset #DFIR #InfoSec Top IPs: 51.77.190.75 - 597 31.70.99.149 - 15 45.142.193.145 - 12 Top ASNs: AS16276 - 597 AS396982 - 36 AS63949 - 18 Top Accounts: hello - 621 Test - 12 07va67qh - 12 Top ISPs: OVH SAS - 597 Google LLC - 36 IONOS SE - 15 Top Clients: Unknown - 708 Top Software: Unknown - 708 Top Keyboards: Unknown - 708 Top IP Classification: hosting - 675 Unknown - 18 hosting & proxy - 15 Pastebin links with full 24-hr RDP Honeypot IOC Lists: Bad API request, invalid api_dev_key #CyberSec #SOC #Blueteam #SecOps #Security
0
0
0
rdpsnitch
RDP Snitch @rdpsnitch@infosec.exchange · 3d ago
2026-07-22 RDP #Honeypot IOCs - 472 scans Thread with top 3 features in each category and links to the full dataset #DFIR #InfoSec Top IPs: 51.77.190.75 - 398 31.70.99.149 - 10 45.142.193.145 - 8 Top ASNs: AS16276 - 398 AS396982 - 24 AS63949 - 12 Top Accounts: hello - 414 Test - 8 07va67qh - 8 Top ISPs: OVH SAS - 398 Google LLC - 24 IONOS SE - 10 Top Clients: Unknown - 472 Top Software: Unknown - 472 Top Keyboards: Unknown - 472 Top IP Classification: hosting - 450 Unknown - 12 hosting & proxy - 10 Pastebin links with full 24-hr RDP Honeypot IOC Lists: Bad API request, invalid api_dev_key #CyberSec #SOC #Blueteam #SecOps #Security
0
0
0
rdpsnitch
RDP Snitch @rdpsnitch@infosec.exchange · 3d ago
2026-07-22 RDP #Honeypot IOCs - 236 scans Thread with top 3 features in each category and links to the full dataset #DFIR #InfoSec Top IPs: 51.77.190.75 - 199 31.70.99.149 - 5 45.142.193.145 - 4 Top ASNs: AS16276 - 199 AS396982 - 12 AS63949 - 6 Top Accounts: hello - 207 Test - 4 07va67qh - 4 Top ISPs: OVH SAS - 199 Google LLC - 12 IONOS SE - 5 Top Clients: Unknown - 236 Top Software: Unknown - 236 Top Keyboards: Unknown - 236 Top IP Classification: hosting - 225 Unknown - 6 hosting & proxy - 5 Pastebin links with full 24-hr RDP Honeypot IOC Lists: Bad API request, invalid api_dev_key #CyberSec #SOC #Blueteam #SecOps #Security
0
0
0
rnbwkat
ʇɐʞlᴉʌƎ 🇺🇦🌈 is rnbwkat @rnbwkat@infosec.exchange · 4d ago
Stood up a fresh honeypot in Madrid, pointed a domain I registered in 2008 at it, and just watched. 36 hours in, my logs are full of domain-name-flavored usernames and passwords, generously seasoned with 2008, 2009, 2010, all the way to 2030 and other years that line up a little too well with when I actually regisstered the thing. I did not publish my registration date anywhere. The bots found out anyway and are now trying it as both a username AND password, just to cover their bases. Efficient. Rude. Efficient. Something in the pipeline is pulling WHOIS data and using domain age as a password hint. Not earth shattering, not life changing, but in just about a day you start to see the patterns. Now I will wait to see the payloads they drop and further exploration of the 2 additional "hosts" connected to this little decoy. What are you doing on this fabulous Wednesday? yes yes, so I'm a nerd - I admit it. And you? Will you admit it too? Do you also have a friendly Flamingo helping set these up? #cybersecurity #Infosec #honeypot #nerd #SashaTheFlamingo @sashatheflamingo@infosec.exchange
0
0
0
rdpsnitch
RDP Snitch @rdpsnitch@infosec.exchange · 4d ago
2026-07-21 RDP #Honeypot IOCs - 5607 scans Thread with top 3 features in each category and links to the full dataset #DFIR #InfoSec Top IPs: 152.42.212.128 - 4995 168.144.29.9 - 510 134.122.44.174 - 30 Top ASNs: AS14061 - 5535 AS396982 - 27 AS12989 - 15 Top Accounts: hello - 5538 root - 15 (empty) - 9 Top ISPs: DigitalOcean, LLC - 5535 Google LLC - 27 MISTRAL - 15 Top Clients: Unknown - 5607 Top Software: Unknown - 5607 Top Keyboards: Unknown - 5607 Top IP Classification: hosting - 5556 hosting & proxy - 33 Unknown - 12 Pastebin links with full 24-hr RDP Honeypot IOC Lists: Bad API request, invalid api_dev_key #CyberSec #SOC #Blueteam #SecOps #Security
0
0
0
rdpsnitch
RDP Snitch @rdpsnitch@infosec.exchange · 4d ago
2026-07-21 RDP #Honeypot IOCs - 3738 scans Thread with top 3 features in each category and links to the full dataset #DFIR #InfoSec Top IPs: 152.42.212.128 - 3330 168.144.29.9 - 340 134.122.44.174 - 20 Top ASNs: AS14061 - 3690 AS396982 - 18 AS12989 - 10 Top Accounts: hello - 3692 root - 10 (empty) - 6 Top ISPs: DigitalOcean, LLC - 3690 Google LLC - 18 MISTRAL - 10 Top Clients: Unknown - 3738 Top Software: Unknown - 3738 Top Keyboards: Unknown - 3738 Top IP Classification: hosting - 3704 hosting & proxy - 22 Unknown - 8 Pastebin links with full 24-hr RDP Honeypot IOC Lists: Bad API request, invalid api_dev_key #CyberSec #SOC #Blueteam #SecOps #Security
0
0
0
SecuriLee
SecuriLee🇨🇭 @SecuriLee@infosec.exchange · 5d ago
I run two honeypots: a web tarpit (MIRE) and a bank of OpenCanary port sensors (TOCE). For 7 months they kept separate guest books. Then I joined them. 91,602 web attackers ∩ 100,836 port scanners = just 1,405 IPs in both. In that sliver: one operator wearing 159 VPN "cloaks" — unmasked by a fossilized 2019 Chrome user agent. And a bot that spells it "Mozlila". Full story: https://about.ciso.li/TOCE/reports/crossfire.html #honeypot #infosec #threatintel
0
0
0
rdpsnitch
RDP Snitch @rdpsnitch@infosec.exchange · 5d ago
2026-07-19 RDP #Honeypot IOCs - 3366 scans Thread with top 3 features in each category and links to the full dataset #DFIR #InfoSec Top IPs: 152.42.212.128 - 3231 102.88.21.136 - 57 104.248.190.235 - 12 Top ASNs: AS14061 - 3249 AS29465 - 57 AS396982 - 36 Top Accounts: hello - 3288 vrgl5746 - 12 (empty) - 9 Top ISPs: DigitalOcean, LLC - 3249 MTN NIGERIA Communication limited - 57 Google LLC - 36 Top Clients: Unknown - 3366 Top Software: Unknown - 3366 Top Keyboards: Unknown - 3366 Top IP Classification: hosting - 3300 mobile & hosting - 57 hosting & proxy - 3 Pastebin links with full 24-hr RDP Honeypot IOC Lists: Bad API request, invalid api_dev_key #CyberSec #SOC #Blueteam #SecOps #Security
0
0
0
rdpsnitch
RDP Snitch @rdpsnitch@infosec.exchange · 5d ago
2026-07-19 RDP #Honeypot IOCs - 3365 scans Thread with top 3 features in each category and links to the full dataset #DFIR #InfoSec Top IPs: 152.42.212.128 - 3230 102.88.21.136 - 57 104.248.190.235 - 12 Top ASNs: AS14061 - 3248 AS29465 - 57 AS396982 - 36 Top Accounts: hello - 3287 vrgl5746 - 12 (empty) - 9 Top ISPs: DigitalOcean, LLC - 3248 MTN NIGERIA Communication limited - 57 Google LLC - 36 Top Clients: Unknown - 3365 Top Software: Unknown - 3365 Top Keyboards: Unknown - 3365 Top IP Classification: hosting - 3299 mobile & hosting - 57 hosting & proxy - 3 Pastebin links with full 24-hr RDP Honeypot IOC Lists: Bad API request, invalid api_dev_key #CyberSec #SOC #Blueteam #SecOps #Security
0
0
0
rdpsnitch
RDP Snitch @rdpsnitch@infosec.exchange · 5d ago
2026-07-19 RDP #Honeypot IOCs - 3364 scans Thread with top 3 features in each category and links to the full dataset #DFIR #InfoSec Top IPs: 152.42.212.128 - 3229 102.88.21.136 - 57 104.248.190.235 - 12 Top ASNs: AS14061 - 3247 AS29465 - 57 AS396982 - 36 Top Accounts: hello - 3286 vrgl5746 - 12 (empty) - 9 Top ISPs: DigitalOcean, LLC - 3247 MTN NIGERIA Communication limited - 57 Google LLC - 36 Top Clients: Unknown - 3364 Top Software: Unknown - 3364 Top Keyboards: Unknown - 3364 Top IP Classification: hosting - 3298 mobile & hosting - 57 hosting & proxy - 3 Pastebin links with full 24-hr RDP Honeypot IOC Lists: Bad API request, invalid api_dev_key #CyberSec #SOC #Blueteam #SecOps #Security
0
0
0
dblanko
D. Blanko @dblanko@infosec.exchange · Jul 11, 2026
Replying to @dblanko@infosec.exchange
VNC: 60 events, 2 IPs. One scanner ran its entire wordlist in 2.5 seconds — 19:32:40 to 19:32:43 UTC. 563 IPs appeared exactly once. 14 IPs generated 10,000+ events each. Full dataset and analysis scripts: github.com/dblanko/honeypot-analysis Full post: sshlab.eu/blog/544908-events-in-20-days-opencanary-multi-service-honeypot-data-74cfe747 #honeypot #infosec #threatintelligence #redis #rdp
0
1
0