X XFediYour place in the Fediverse
XFEDI

#honeypot

ActivityPub

Public posts with this hashtag.

RDP Snitch@[email protected]

2026-10-22 RDP #Honeypot IOCs - 908 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
221.6.237.66 - 90
82.223.10.125 - 70
82.223.17.218 - 68

Top ASNs:
AS8560 - 340
AS4837 - 90
AS8075 - 80

Top Accounts:
142.93.8.59 - 770
hello - 84
Administr - 10

Top ISPs:
arsys.es - 284
CNC Group CHINA169 Jiangsu Province Network - 90
Speed NET Internet Banda Larga Ltda - 68

Top Clients:
Unknown - 908

Top Software:
Unknown - 908

Top Keyboards:
Unknown - 908

Top IP Classification:
hosting - 486
Unknown - 318
mobile - 66

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

↩ Reply ♡ 0 · ↻ 0 ↗ Original
RDP Snitch@[email protected]

2026-10-22 RDP #Honeypot IOCs - 454 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
221.6.237.66 - 45
82.223.10.125 - 35
82.223.17.218 - 34

Top ASNs:
AS8560 - 170
AS4837 - 45
AS8075 - 40

Top Accounts:
142.93.8.59 - 385
hello - 42
Administr - 5

Top ISPs:
arsys.es - 142
CNC Group CHINA169 Jiangsu Province Network - 45
Speed NET Internet Banda Larga Ltda - 34

Top Clients:
Unknown - 454

Top Software:
Unknown - 454

Top Keyboards:
Unknown - 454

Top IP Classification:
hosting - 243
Unknown - 159
mobile - 33

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

↩ Reply ♡ 0 · ↻ 0 ↗ Original
OffSequence@[email protected]

PHP2Shell field report — the attacker-side view.

The first exploit-shaped request hit our Mirage honeypot fleet at 21:57 UTC on 20 Oct, ~16h before the patch embargo lifted. Over the next 48h: 9 source IPs, 7 countries, 2 distinct attack shapes.

Highlights:

One actor swept body size <1KB → 16KB+, 200+ unique payloads in 2 min — live calibration of the OOM trigger
The lead tool stamps ----p2shell<hex> into its multipart boundary: a zero-false-positive detection tell we haven’t seen documented elsewhere
A B8RAT/1.0 actor reaching for the deserialization path (CVE-2026-109619) while others hammer the OOM path (CVE-2026-109618)
Independent confirmation of the pre-disclosure exploitation Amazon & Cloudflare reported, from a second sensor network

Full writeup + IOCs:
https://offseq.com/en/research/php2shell-first-48-hours/

#infosec #PHP2Shell #threatintel #honeypot #PHP #CVE

OffSeqPHP2Shell in the wild: the first 48 hours on a honeypot fleet – OffSeqPHP2Shell leaked before its patch, and the first exploit-shaped request hit OffSeq's Mirage fleet about sixteen hours before the fix shipped.
↩ Reply ♡ 0 · ↻ 0 ↗ Original
SecuriLee🇨🇭@[email protected]

🎸 Don’t Stop Me Now: MIRE/C³ release 2026.11 is out early.

It seems the world (or at least the attackers and scanners on the Internet) has been searching for AI-proxy config files: the LiteLLM-style proxies people put in front of their AI models, often with the cloud keys sitting right there in the config.

So The MIRE now hands those out too. The AWS key inside is a canary.

4 keys were used in the first 12 hours. The fastest was in use 14 seconds after it was taken. Each key was tried from between 53 and 93 different addresses, one call each: a residential proxy pool doing its job.

The calls tell the story: “who am I?”, then how much email the account may send, whether it can send texts, and which AI models it can run. Spam and free AI, on someone else’s bill.

Only “who am I?” ever worked. Of course!

Also new in 2026.11:
🪤 More bait where attackers actually look: Terraform, Kubernetes, shell history, build scripts, .bak copies
🏢 Every site tells one consistent story
🔐 A login for every SaaS dashboard that was never there
🔎 About 9'400 attacks hidden in query strings since July, now caught

30 different canaries used since 9 October. The full field report is to follow.

https://mire.cc/dont-stop-me-now/

#cybersecurity #AI #MIREC3 #honeypot #infosec #ThreatIntel #LLMjacking #AWS #DeceptionTechnology

MIRE/C³Don’t Stop Me Now · MIRE/C³Analysis of the gaps from researching the logs showed many attackers searching for AI-proxy config files.
↩ Reply ♡ 0 · ↻ 0 ↗ Original
RDP Snitch@[email protected]

2026-10-21 RDP #Honeypot IOCs - 302 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
165.22.11.151 - 78
70.34.218.91 - 76
168.144.137.105 - 24

Top ASNs:
AS14061 - 102
AS20473 - 76
AS396982 - 24

Top Accounts:
probe - 154
hello - 54
142.93.8.59 - 28

Top ISPs:
DigitalOcean, LLC - 102
The Constant Company - 76
Google LLC - 24

Top Clients:
Unknown - 302

Top Software:
Unknown - 302

Top Keyboards:
Unknown - 302

Top IP Classification:
hosting - 260
Unknown - 34
proxy - 4

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

↩ Reply ♡ 0 · ↻ 0 ↗ Original
RDP Snitch@[email protected]

2026-10-21 RDP #Honeypot IOCs - 151 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
165.22.11.151 - 39
70.34.218.91 - 38
168.144.137.105 - 12

Top ASNs:
AS14061 - 51
AS20473 - 38
AS396982 - 12

Top Accounts:
probe - 77
hello - 27
142.93.8.59 - 14

Top ISPs:
DigitalOcean, LLC - 51
The Constant Company - 38
Google LLC - 12

Top Clients:
Unknown - 151

Top Software:
Unknown - 151

Top Keyboards:
Unknown - 151

Top IP Classification:
hosting - 130
Unknown - 17
proxy - 2

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

↩ Reply ♡ 0 · ↻ 0 ↗ Original
RDP Snitch@[email protected]

2026-10-20 RDP #Honeypot IOCs - 249 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
168.144.137.105 - 36
216.226.78.10 - 30
157.66.49.187 - 30

Top ASNs:
AS150895 - 60
AS14061 - 39
AS396982 - 36

Top Accounts:
hello - 120
Administr - 24
eltons - 15

Top ISPs:
DigitalOcean, LLC - 39
Google LLC - 36
LNK SYSTEMS MUNTENIA SRL - 30

Top Clients:
Unknown - 249

Top Software:
Unknown - 249

Top Keyboards:
Unknown - 249

Top IP Classification:
hosting - 162
Unknown - 57
hosting & proxy - 15

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

↩ Reply ♡ 0 · ↻ 0 ↗ Original
Sekoia@[email protected]

An attacker found our Flowise #honeypot, a decoy #AI platform, and literally tried to turn the agent into its very own attack assistant.

They pulled credentials, planted a callback, and fed the model data from a likely iGaming target.

https://buff.ly/AMujIsR

Media attachment
www.sekoia.comSekoia Honeypot Captures an Attack on GenAI InfrastructureSekoia's TDR team ran a decoy Flowise server to study attacks on GenAI platforms. One threat actor stole its credentials and tried to misuse its AI agent.
↩ Reply ♡ 0 · ↻ 0 ↗ Original
RDP Snitch@[email protected]

2026-10-19 RDP #Honeypot IOCs - 8964 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
154.36.174.33 - 7245
45.154.96.17 - 1566
136.244.100.79 - 18

Top ASNs:
AS979 - 7245
AS212815 - 1566
AS396982 - 36

Top Accounts:
hello - 7278
administrator - 108
Administrator - 90

Top ISPs:
NetLab Global - 7245
Dyjix SAS - 1566
Google LLC - 36

Top Clients:
Unknown - 8964

Top Software:
Unknown - 8964

Top Keyboards:
Unknown - 8964

Top IP Classification:
Unknown - 7263
hosting - 1695
mobile - 3

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

↩ Reply ♡ 0 · ↻ 0 ↗ Original
RDP Snitch@[email protected]

2026-10-19 RDP #Honeypot IOCs - 5976 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
154.36.174.33 - 4830
45.154.96.17 - 1044
136.244.100.79 - 12

Top ASNs:
AS979 - 4830
AS212815 - 1044
AS396982 - 24

Top Accounts:
hello - 4852
administrator - 72
Administrator - 60

Top ISPs:
NetLab Global - 4830
Dyjix SAS - 1044
Google LLC - 24

Top Clients:
Unknown - 5976

Top Software:
Unknown - 5976

Top Keyboards:
Unknown - 5976

Top IP Classification:
Unknown - 4842
hosting - 1130
mobile - 2

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

↩ Reply ♡ 0 · ↻ 0 ↗ Original
RDP Snitch@[email protected]

2026-10-19 RDP #Honeypot IOCs - 2988 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
154.36.174.33 - 2415
45.154.96.17 - 522
136.244.100.79 - 6

Top ASNs:
AS979 - 2415
AS212815 - 522
AS396982 - 12

Top Accounts:
hello - 2426
administrator - 36
Administrator - 30

Top ISPs:
NetLab Global - 2415
Dyjix SAS - 522
Google LLC - 12

Top Clients:
Unknown - 2988

Top Software:
Unknown - 2988

Top Keyboards:
Unknown - 2988

Top IP Classification:
Unknown - 2421
hosting - 565
mobile - 1

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

↩ Reply ♡ 0 · ↻ 0 ↗ Original