X XFediYour place in the Fediverse
XFEDI

#blueteam

ActivityPub

Public posts with this hashtag.

RDP Snitch@[email protected]

2026-10-24 RDP #Honeypot IOCs - 1472 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
172.213.17.10 - 440
206.71.149.246 - 214
45.65.180.246 - 80

Top ASNs:
AS8075 - 530
AS8560 - 316
AS399629 - 214

Top Accounts:
142.93.8.59 - 678
hello - 502
probe - 218

Top ISPs:
Microsoft Corporation - 512
arsys.es - 260
BL Networks - 214

Top Clients:
Unknown - 1472

Top Software:
Unknown - 1472

Top Keyboards:
Unknown - 1472

Top IP Classification:
hosting - 872
Unknown - 564
mobile - 26

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

↩ Reply ♡ 0 · ↻ 0 ↗ Original
RDP Snitch@[email protected]

2026-10-24 RDP #Honeypot IOCs - 736 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
172.213.17.10 - 220
206.71.149.246 - 107
45.65.180.246 - 40

Top ASNs:
AS8075 - 265
AS8560 - 158
AS399629 - 107

Top Accounts:
142.93.8.59 - 339
hello - 251
probe - 109

Top ISPs:
Microsoft Corporation - 256
arsys.es - 130
BL Networks - 107

Top Clients:
Unknown - 736

Top Software:
Unknown - 736

Top Keyboards:
Unknown - 736

Top IP Classification:
hosting - 436
Unknown - 282
mobile - 13

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

↩ Reply ♡ 0 · ↻ 0 ↗ Original
RDP Snitch@[email protected]

2026-10-23 RDP #Honeypot IOCs - 1362 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
45.65.180.246 - 153
82.223.35.19 - 111
43.245.183.46 - 87

Top ASNs:
AS8560 - 474
AS266266 - 153
AS8075 - 147

Top Accounts:
142.93.8.59 - 1140
probe - 69
hello - 45

Top ISPs:
arsys.es - 411
Speed NET Internet Banda Larga Ltda - 153
Microsoft Corporation - 93

Top Clients:
Unknown - 1362

Top Software:
Unknown - 1362

Top Keyboards:
Unknown - 1362

Top IP Classification:
hosting - 690
Unknown - 522
mobile - 87

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

↩ Reply ♡ 0 · ↻ 0 ↗ Original
RDP Snitch@[email protected]

2026-10-23 RDP #Honeypot IOCs - 908 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
45.65.180.246 - 102
82.223.35.19 - 74
43.245.183.46 - 58

Top ASNs:
AS8560 - 316
AS266266 - 102
AS8075 - 98

Top Accounts:
142.93.8.59 - 760
probe - 46
hello - 30

Top ISPs:
arsys.es - 274
Speed NET Internet Banda Larga Ltda - 102
Microsoft Corporation - 62

Top Clients:
Unknown - 908

Top Software:
Unknown - 908

Top Keyboards:
Unknown - 908

Top IP Classification:
hosting - 460
Unknown - 348
mobile - 58

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

↩ Reply ♡ 0 · ↻ 0 ↗ Original
RDP Snitch@[email protected]

2026-10-23 RDP #Honeypot IOCs - 454 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
45.65.180.246 - 51
82.223.35.19 - 37
43.245.183.46 - 29

Top ASNs:
AS8560 - 158
AS266266 - 51
AS8075 - 49

Top Accounts:
142.93.8.59 - 380
probe - 23
hello - 15

Top ISPs:
arsys.es - 137
Speed NET Internet Banda Larga Ltda - 51
Microsoft Corporation - 31

Top Clients:
Unknown - 454

Top Software:
Unknown - 454

Top Keyboards:
Unknown - 454

Top IP Classification:
hosting - 230
Unknown - 174
mobile - 29

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

↩ Reply ♡ 0 · ↻ 0 ↗ Original
Touchpoint Security@[email protected]

Today's brief:
- PHP2Shell CVE-2026-109618/-109619 (CVSS v4 9.2): fixed 8.5.12/8.4.27/8.3.36/8.2.35. Probed since Oct 17; hunt PHP_SESSION_UPLOAD_PROGRESS + LFI of sess_ files
- Arista VCO CVE-2026-114625 (9.9), exploited: fixed 5.2.3.18/6.1.3.10/6.4.2.12
- LiteLLM 1.107.0 backdoored; exfil www.litellm[.]dev/healthcheck; pin 1.106.2, rotate secrets
- GitLab CVE-2026-110264 (10.0)

https://tp-security.com/news/cyber-brief-2026-10-23-php2shell-arista-velocloud-litellm

#InfoSec #PatchNow #BlueTeam #SupplyChainSecurity

Touchpoint SecurityPHP2Shell Attacks Predate Patches as Arista Fixes an Exploited VeloCloud Zero-Day and a Backdoored LiteLLM Release Targets AI CredentialsPHP2Shell attacks began before patches, Arista fixes an exploited VeloCloud zero-day, and a backdoored LiteLLM release steals cloud and AI keys.
↩ Reply ♡ 0 · ↻ 0 ↗ Original
RDP Snitch@[email protected]

2026-10-22 RDP #Honeypot IOCs - 908 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
221.6.237.66 - 90
82.223.10.125 - 70
82.223.17.218 - 68

Top ASNs:
AS8560 - 340
AS4837 - 90
AS8075 - 80

Top Accounts:
142.93.8.59 - 770
hello - 84
Administr - 10

Top ISPs:
arsys.es - 284
CNC Group CHINA169 Jiangsu Province Network - 90
Speed NET Internet Banda Larga Ltda - 68

Top Clients:
Unknown - 908

Top Software:
Unknown - 908

Top Keyboards:
Unknown - 908

Top IP Classification:
hosting - 486
Unknown - 318
mobile - 66

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

↩ Reply ♡ 0 · ↻ 0 ↗ Original
RDP Snitch@[email protected]

2026-10-22 RDP #Honeypot IOCs - 454 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
221.6.237.66 - 45
82.223.10.125 - 35
82.223.17.218 - 34

Top ASNs:
AS8560 - 170
AS4837 - 45
AS8075 - 40

Top Accounts:
142.93.8.59 - 385
hello - 42
Administr - 5

Top ISPs:
arsys.es - 142
CNC Group CHINA169 Jiangsu Province Network - 45
Speed NET Internet Banda Larga Ltda - 34

Top Clients:
Unknown - 454

Top Software:
Unknown - 454

Top Keyboards:
Unknown - 454

Top IP Classification:
hosting - 243
Unknown - 159
mobile - 33

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

↩ Reply ♡ 0 · ↻ 0 ↗ Original
B'ad Samurai :ifin:@[email protected]

Let’s not forget .php could be a top level domain.

Be sure to let ICANN know on the 17th how much a file name ending in .php would improve your life, much like today.

https://newgtldprogram-aps.icann.org/applications/KKWT2621T-T46596-R/summary

#php #php2shell #icann #blueteam #dns

newgtldprogram-aps.icann.orgApplication DetailsNew gTLD Program: 2026 Round public application information, including application status.
↩ Reply ♡ 0 · ↻ 0 ↗ Original
RDP Snitch@[email protected]

2026-10-21 RDP #Honeypot IOCs - 302 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
165.22.11.151 - 78
70.34.218.91 - 76
168.144.137.105 - 24

Top ASNs:
AS14061 - 102
AS20473 - 76
AS396982 - 24

Top Accounts:
probe - 154
hello - 54
142.93.8.59 - 28

Top ISPs:
DigitalOcean, LLC - 102
The Constant Company - 76
Google LLC - 24

Top Clients:
Unknown - 302

Top Software:
Unknown - 302

Top Keyboards:
Unknown - 302

Top IP Classification:
hosting - 260
Unknown - 34
proxy - 4

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

↩ Reply ♡ 0 · ↻ 0 ↗ Original
RDP Snitch@[email protected]

2026-10-21 RDP #Honeypot IOCs - 151 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
165.22.11.151 - 39
70.34.218.91 - 38
168.144.137.105 - 12

Top ASNs:
AS14061 - 51
AS20473 - 38
AS396982 - 12

Top Accounts:
probe - 77
hello - 27
142.93.8.59 - 14

Top ISPs:
DigitalOcean, LLC - 51
The Constant Company - 38
Google LLC - 12

Top Clients:
Unknown - 151

Top Software:
Unknown - 151

Top Keyboards:
Unknown - 151

Top IP Classification:
hosting - 130
Unknown - 17
proxy - 2

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

↩ Reply ♡ 0 · ↻ 0 ↗ Original
✨ blueteamjobs.com@[email protected]

🛡️ Cybersecurity Engineer Mid - Continuous Monitoring at AGE Solutions
📍 Fort Meade, MD, US / Alexandria, VA, US +1 more

Apply: https://blueteamjobs.com/job/cybersecurity-engineer-mid-continuous-monitoring-age-solutions-wsz98g/

#BlueTeam #InfoSec #CyberSecurityJobs #SecurityEngineer

BlueTeamJobsCybersecurity Engineer Mid - Continuous Monitoring at AGE…AGE Solutions is hiring a Cybersecurity Engineer Mid - Continuous Monitoring, Fort Meade, MD. About Us AGE Solutions is a premier technology and…
↩ Reply ♡ 0 · ↻ 0 ↗ Original
✨ blueteamjobs.com@[email protected]

🛡️ Staff Engineer, Cloud Security at Toast
📍 Remote (US)
💰 $193k–$309k/yr

Apply: https://blueteamjobs.com/job/staff-engineer-cloud-security-toast-jsz3ws/

#BlueTeam #InfoSec #CyberSecurityJobs #CloudSecurityEngineer

BlueTeamJobsStaff Engineer, Cloud Security at Toast | BlueTeamJobsToast is hiring a Staff Engineer, Cloud Security, Remote (US). Pay: $193k–$309k a year. Toast creates technology to help restaurants and local businesses…
↩ Reply ♡ 0 · ↻ 0 ↗ Original
OffSequence@[email protected]

CVE-2026-87095: A CRITICAL auth bypass in Acronis Cyber Infrastructure (pre-6.0.1-112/6.1.1-64/6.2.1-71) risks data disclosure & tampering (CVSS 9.1). No patch confirmed. Limit network access & monitor logs. https://radar.offseq.com/threat/cve-2026-87095-cwe-863-in-acronis-acronis-cyber-infrastructure-10e3c7d3d7e8e2e5 #OffSeq #CVE #Acronis #Vuln #BlueTeam

Critical threat: CVE-2026-87095: CWE-863 in Acronis Acronis Cyber Infrastructure
OffSeq Threat RadarCVE-2026-87095: CWE-863 in Acronis Acronis Cyber… | Threat RadarCVE-2026-87095 is a critical vulnerability in Acronis Cyber Infrastructure involving improper authorization checks, leading to sensitive information disclosure…
↩ Reply ♡ 0 · ↻ 0 ↗ Original
RDP Snitch@[email protected]

2026-10-20 RDP #Honeypot IOCs - 249 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
168.144.137.105 - 36
216.226.78.10 - 30
157.66.49.187 - 30

Top ASNs:
AS150895 - 60
AS14061 - 39
AS396982 - 36

Top Accounts:
hello - 120
Administr - 24
eltons - 15

Top ISPs:
DigitalOcean, LLC - 39
Google LLC - 36
LNK SYSTEMS MUNTENIA SRL - 30

Top Clients:
Unknown - 249

Top Software:
Unknown - 249

Top Keyboards:
Unknown - 249

Top IP Classification:
hosting - 162
Unknown - 57
hosting & proxy - 15

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

↩ Reply ♡ 0 · ↻ 0 ↗ Original
B'ad Samurai :ifin:@[email protected]

Love lists and doing the basics? I really, really do. So I’m speaking about it this Friday at BSidesPDX.

This year’s theme is genuine human connection so Put Community Lists in your Kill Chain is a celebratory look at the great impact lists can have within your security program.

And there’s not a lick of AI in the talk or derived content.

https://bsidespdx.org/events/2026/speakers.html#session-P9HCXH

#bsides #bsidespdx #blocklist #blueteam

bsidespdx.orgSpeakers | BSidesPDXBSides PDX is a gathering of the most interesting infosec minds in Portland and the Pacific Northwest! Our passion about all things security has dr...
↩ Reply ♡ 0 · ↻ 0 ↗ Original
✨ blueteamjobs.com@[email protected]

🛡️ Incident Response Analyst Senior at Accenture Federal Services
📍 Leesburg, VA, US

Apply: https://blueteamjobs.com/job/incident-response-analyst-senior-accenture-federal-services-pb24cp/

#BlueTeam #InfoSec #CyberSecurityJobs #IncidentResponder

BlueTeamJobsIncident Response Analyst Senior at Accenture Federal…Accenture Federal Services is hiring a Incident Response Analyst Senior, Leesburg, VA. At Accenture Federal Services, nothing matters more than helping…
↩ Reply ♡ 0 · ↻ 0 ↗ Original
✨ blueteamjobs.com@[email protected]

🛡️ Manager, Security Operations Center at Huntress
📍 US
💰 $165k–$185k/yr

Apply: https://blueteamjobs.com/job/manager-security-operations-center-huntress-xftgk9/

#BlueTeam #InfoSec #CyberSecurityJobs #SecurityOperationsLeadership

BlueTeamJobsManager, Security Operations Center at HuntressHuntress is hiring a Manager, Security Operations Center, United States. Pay: $165k–$185k a year. What We Do: Cybercrime is growing, and more businesses…
↩ Reply ♡ 0 · ↻ 0 ↗ Original
RDP Snitch@[email protected]

2026-10-19 RDP #Honeypot IOCs - 8964 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
154.36.174.33 - 7245
45.154.96.17 - 1566
136.244.100.79 - 18

Top ASNs:
AS979 - 7245
AS212815 - 1566
AS396982 - 36

Top Accounts:
hello - 7278
administrator - 108
Administrator - 90

Top ISPs:
NetLab Global - 7245
Dyjix SAS - 1566
Google LLC - 36

Top Clients:
Unknown - 8964

Top Software:
Unknown - 8964

Top Keyboards:
Unknown - 8964

Top IP Classification:
Unknown - 7263
hosting - 1695
mobile - 3

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

↩ Reply ♡ 0 · ↻ 0 ↗ Original
RDP Snitch@[email protected]

2026-10-19 RDP #Honeypot IOCs - 5976 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
154.36.174.33 - 4830
45.154.96.17 - 1044
136.244.100.79 - 12

Top ASNs:
AS979 - 4830
AS212815 - 1044
AS396982 - 24

Top Accounts:
hello - 4852
administrator - 72
Administrator - 60

Top ISPs:
NetLab Global - 4830
Dyjix SAS - 1044
Google LLC - 24

Top Clients:
Unknown - 5976

Top Software:
Unknown - 5976

Top Keyboards:
Unknown - 5976

Top IP Classification:
Unknown - 4842
hosting - 1130
mobile - 2

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

↩ Reply ♡ 0 · ↻ 0 ↗ Original
RDP Snitch@[email protected]

2026-10-19 RDP #Honeypot IOCs - 2988 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
154.36.174.33 - 2415
45.154.96.17 - 522
136.244.100.79 - 6

Top ASNs:
AS979 - 2415
AS212815 - 522
AS396982 - 12

Top Accounts:
hello - 2426
administrator - 36
Administrator - 30

Top ISPs:
NetLab Global - 2415
Dyjix SAS - 522
Google LLC - 12

Top Clients:
Unknown - 2988

Top Software:
Unknown - 2988

Top Keyboards:
Unknown - 2988

Top IP Classification:
Unknown - 2421
hosting - 565
mobile - 1

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

↩ Reply ♡ 0 · ↻ 0 ↗ Original
✨ blueteamjobs.com@[email protected]

🛡️ Manager, MDR & Threat Hunting at Zscaler
📍 Remote (US)
💰 $144k–$205k/yr

Apply: https://blueteamjobs.com/job/manager-mdr-and-threat-hunting-zscaler-x1fw4e/

#BlueTeam #InfoSec #CyberSecurityJobs #SecurityOperationsLeadership

BlueTeamJobsManager, MDR & Threat Hunting at Zscaler | BlueTeamJobsZscaler is hiring a Manager, MDR & Threat Hunting, Remote (US). Pay: $144k–$205k a year. Zscaler (NASDAQ: ZS) accelerates digital transformation so…
↩ Reply ♡ 0 · ↻ 0 ↗ Original
Solomon Neas@[email protected]

#introduction, round two. I'm Solomon: retired chef, network and systems engineer, CySA+, finishing an M.S. in cybersecurity at USF.

I build Brigade, open-source tooling that keeps AI coding agents honest: verified runs with signed exit codes, a code graph agents check before editing, and an evidence log of what they did. I also run a homelab SOC on Wazuh, TheHive, and MISP.

Here for blue team, agent security, and homelabs.

https://brigade.tools

#infosec #blueteam #aisecurity #homelab

BrigadeBrigade - trackable work for coding-agent fleetsTrack coding-agent tasks, receipts, shared memory, and synced tools across tools, repos, and sessions. Local files. No required daemon.
↩ Reply ♡ 0 · ↻ 0 ↗ Original
✨ blueteamjobs.com@[email protected]

🛡️ Senior Incident Response Consultant, Rapid Response at Sophos
📍 Remote (CA)
💰 CA$109k–CA$181k/yr

Apply: https://blueteamjobs.com/job/senior-incident-response-consultant-rapid-response-sophos-3vzj2h/

#BlueTeam #InfoSec #CyberSecurityJobs #IncidentResponder

BlueTeamJobsSenior Incident Response Consultant, Rapid Response at…Sophos is hiring a Senior Incident Response Consultant, Rapid Response, Remote (CA). Pay: CA$109k–CA$181k a year. About Us Sophos is a cybersecurity…
↩ Reply ♡ 0 · ↻ 0 ↗ Original