#SOC

2026-10-24 RDP #Honeypot IOCs - 2208 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
172.213.17.10 - 660
206.71.149.246 - 321
45.65.180.246 - 120

Top ASNs:
AS8075 - 795
AS8560 - 474
AS399629 - 321

Top Accounts:
142.93.8.59 - 1017
hello - 753
probe - 327

Top ISPs:
Microsoft Corporation - 768
arsys.es - 390
BL Networks - 321

Top Clients:
Unknown - 2208

Top Software:
Unknown - 2208

Top Keyboards:
Unknown - 2208

Top IP Classification:
hosting - 1308
Unknown - 846
mobile - 39

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

2026-10-24 RDP #Honeypot IOCs - 1472 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
172.213.17.10 - 440
206.71.149.246 - 214
45.65.180.246 - 80

Top ASNs:
AS8075 - 530
AS8560 - 316
AS399629 - 214

Top Accounts:
142.93.8.59 - 678
hello - 502
probe - 218

Top ISPs:
Microsoft Corporation - 512
arsys.es - 260
BL Networks - 214

Top Clients:
Unknown - 1472

Top Software:
Unknown - 1472

Top Keyboards:
Unknown - 1472

Top IP Classification:
hosting - 872
Unknown - 564
mobile - 26

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

2026-10-24 RDP #Honeypot IOCs - 736 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
172.213.17.10 - 220
206.71.149.246 - 107
45.65.180.246 - 40

Top ASNs:
AS8075 - 265
AS8560 - 158
AS399629 - 107

Top Accounts:
142.93.8.59 - 339
hello - 251
probe - 109

Top ISPs:
Microsoft Corporation - 256
arsys.es - 130
BL Networks - 107

Top Clients:
Unknown - 736

Top Software:
Unknown - 736

Top Keyboards:
Unknown - 736

Top IP Classification:
hosting - 436
Unknown - 282
mobile - 13

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

VLANs & trunking. Cybersecurity work gets calmer when the write-up says exactly what boundary changed, what artifact proved it, and what happens next. I want Windows and Linux commands, configuration files, packet views, auth headers, and event data that show what the system is really doing, not vague reassurance. #Cybersecurity #Infosec #Soc #Dfir Good security notes make the next action obvious. The useful lesson is the one you can defend with evidence.…

2026-10-23 RDP #Honeypot IOCs - 1362 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
45.65.180.246 - 153
82.223.35.19 - 111
43.245.183.46 - 87

Top ASNs:
AS8560 - 474
AS266266 - 153
AS8075 - 147

Top Accounts:
142.93.8.59 - 1140
probe - 69
hello - 45

Top ISPs:
arsys.es - 411
Speed NET Internet Banda Larga Ltda - 153
Microsoft Corporation - 93

Top Clients:
Unknown - 1362

Top Software:
Unknown - 1362

Top Keyboards:
Unknown - 1362

Top IP Classification:
hosting - 690
Unknown - 522
mobile - 87

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

2026-10-23 RDP #Honeypot IOCs - 908 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
45.65.180.246 - 102
82.223.35.19 - 74
43.245.183.46 - 58

Top ASNs:
AS8560 - 316
AS266266 - 102
AS8075 - 98

Top Accounts:
142.93.8.59 - 760
probe - 46
hello - 30

Top ISPs:
arsys.es - 274
Speed NET Internet Banda Larga Ltda - 102
Microsoft Corporation - 62

Top Clients:
Unknown - 908

Top Software:
Unknown - 908

Top Keyboards:
Unknown - 908

Top IP Classification:
hosting - 460
Unknown - 348
mobile - 58

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

2026-10-23 RDP #Honeypot IOCs - 454 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
45.65.180.246 - 51
82.223.35.19 - 37
43.245.183.46 - 29

Top ASNs:
AS8560 - 158
AS266266 - 51
AS8075 - 49

Top Accounts:
142.93.8.59 - 380
probe - 23
hello - 15

Top ISPs:
arsys.es - 137
Speed NET Internet Banda Larga Ltda - 51
Microsoft Corporation - 31

Top Clients:
Unknown - 454

Top Software:
Unknown - 454

Top Keyboards:
Unknown - 454

Top IP Classification:
hosting - 230
Unknown - 174
mobile - 29

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

Guardian Punk SOC cheat sheet PHP update:

- CERT-EU now advises organisations unable to patch immediately to consider isolating internet-facing PHP applications until fixes are applied. PHP has not yet confirmed CVE IDs, affected versions or mechanics; ACSC reports no known active exploitation.
- The five-page SOC analyst cheat sheet pack covers draft detections, hunts, investigation/response and evidence-flow diagrams.

Full pack: $10 per pack through https://t.me/+oLHXMpan_E9iOTFk

Subscription: $5 per month to view full packs through https://t.me/+EhxrWC6CnEhjMTlk

#Guardianpunk #SOC #PHP #php2shell

2026-10-22 RDP #Honeypot IOCs - 908 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
221.6.237.66 - 90
82.223.10.125 - 70
82.223.17.218 - 68

Top ASNs:
AS8560 - 340
AS4837 - 90
AS8075 - 80

Top Accounts:
142.93.8.59 - 770
hello - 84
Administr - 10

Top ISPs:
arsys.es - 284
CNC Group CHINA169 Jiangsu Province Network - 90
Speed NET Internet Banda Larga Ltda - 68

Top Clients:
Unknown - 908

Top Software:
Unknown - 908

Top Keyboards:
Unknown - 908

Top IP Classification:
hosting - 486
Unknown - 318
mobile - 66

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

2026-10-22 RDP #Honeypot IOCs - 454 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
221.6.237.66 - 45
82.223.10.125 - 35
82.223.17.218 - 34

Top ASNs:
AS8560 - 170
AS4837 - 45
AS8075 - 40

Top Accounts:
142.93.8.59 - 385
hello - 42
Administr - 5

Top ISPs:
arsys.es - 142
CNC Group CHINA169 Jiangsu Province Network - 45
Speed NET Internet Banda Larga Ltda - 34

Top Clients:
Unknown - 454

Top Software:
Unknown - 454

Top Keyboards:
Unknown - 454

Top IP Classification:
hosting - 243
Unknown - 159
mobile - 33

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

2026-10-21 RDP #Honeypot IOCs - 302 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
165.22.11.151 - 78
70.34.218.91 - 76
168.144.137.105 - 24

Top ASNs:
AS14061 - 102
AS20473 - 76
AS396982 - 24

Top Accounts:
probe - 154
hello - 54
142.93.8.59 - 28

Top ISPs:
DigitalOcean, LLC - 102
The Constant Company - 76
Google LLC - 24

Top Clients:
Unknown - 302

Top Software:
Unknown - 302

Top Keyboards:
Unknown - 302

Top IP Classification:
hosting - 260
Unknown - 34
proxy - 4

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

2026-10-21 RDP #Honeypot IOCs - 151 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
165.22.11.151 - 39
70.34.218.91 - 38
168.144.137.105 - 12

Top ASNs:
AS14061 - 51
AS20473 - 38
AS396982 - 12

Top Accounts:
probe - 77
hello - 27
142.93.8.59 - 14

Top ISPs:
DigitalOcean, LLC - 51
The Constant Company - 38
Google LLC - 12

Top Clients:
Unknown - 151

Top Software:
Unknown - 151

Top Keyboards:
Unknown - 151

Top IP Classification:
hosting - 130
Unknown - 17
proxy - 2

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

Investigation Scenario 🔎

A user received this SMS: “UPS: Package Delivery Failed. Update your address.”

Browser history shows a visit to a fake UPS site, followed by a POST request to /api/verify.

What do you look for to investigate whether an incident occurred? (Your choice on phone OS)

#InvestigationPath #DFIR #SOC

The FBI raided 40+ homes in Texas running laptop farms for North Korean IT workers. Every check a company runs said "US employee at home": a residential US IP, the company's own laptop, mainstream remote access tools.

The only fake part was the person. We also started labelling those remote access tools properly in our API.

Reputation Radar #16:
https://www.reput.io/blog/reputation-radar-16

#ThreatIntel #NorthKorea #SOC

2026-10-20 RDP #Honeypot IOCs - 249 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
168.144.137.105 - 36
216.226.78.10 - 30
157.66.49.187 - 30

Top ASNs:
AS150895 - 60
AS14061 - 39
AS396982 - 36

Top Accounts:
hello - 120
Administr - 24
eltons - 15

Top ISPs:
DigitalOcean, LLC - 39
Google LLC - 36
LNK SYSTEMS MUNTENIA SRL - 30

Top Clients:
Unknown - 249

Top Software:
Unknown - 249

Top Keyboards:
Unknown - 249

Top IP Classification:
hosting - 162
Unknown - 57
hosting & proxy - 15

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

A difficult investigation isn’t necessarily a dead end. Sometimes the difficulty is a signal that the problem deserves more attention, not less. How you interpret difficulty shapes how you invest our time and effort.

#SOC #InvestigationTheory #DFIR

Log monitoring is for losers.
Automating your SOC is stupid.
Smart people - winners - take sensitive information off the Internet and connect their locations with private circuits.
Instead of watching the breach happen, put the data where it can't be breached.

#cybersecurity #soc #business

2026-10-19 RDP #Honeypot IOCs - 8964 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
154.36.174.33 - 7245
45.154.96.17 - 1566
136.244.100.79 - 18

Top ASNs:
AS979 - 7245
AS212815 - 1566
AS396982 - 36

Top Accounts:
hello - 7278
administrator - 108
Administrator - 90

Top ISPs:
NetLab Global - 7245
Dyjix SAS - 1566
Google LLC - 36

Top Clients:
Unknown - 8964

Top Software:
Unknown - 8964

Top Keyboards:
Unknown - 8964

Top IP Classification:
Unknown - 7263
hosting - 1695
mobile - 3

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

2026-10-19 RDP #Honeypot IOCs - 5976 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
154.36.174.33 - 4830
45.154.96.17 - 1044
136.244.100.79 - 12

Top ASNs:
AS979 - 4830
AS212815 - 1044
AS396982 - 24

Top Accounts:
hello - 4852
administrator - 72
Administrator - 60

Top ISPs:
NetLab Global - 4830
Dyjix SAS - 1044
Google LLC - 24

Top Clients:
Unknown - 5976

Top Software:
Unknown - 5976

Top Keyboards:
Unknown - 5976

Top IP Classification:
Unknown - 4842
hosting - 1130
mobile - 2

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

2026-10-19 RDP #Honeypot IOCs - 2988 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
154.36.174.33 - 2415
45.154.96.17 - 522
136.244.100.79 - 6

Top ASNs:
AS979 - 2415
AS212815 - 522
AS396982 - 12

Top Accounts:
hello - 2426
administrator - 36
Administrator - 30

Top ISPs:
NetLab Global - 2415
Dyjix SAS - 522
Google LLC - 12

Top Clients:
Unknown - 2988

Top Software:
Unknown - 2988

Top Keyboards:
Unknown - 2988

Top IP Classification:
Unknown - 2421
hosting - 565
mobile - 1

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security