2026-01-23 RDP #Honeypot IOCs - 840 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
134.199.198.215 - 495
37.19.198.89 - 48
47.25.7.101 - 42

Top ASNs:
AS14061 - 525
AS212238 - 48
AS20115 - 42

Top Accounts:
hello - 615
142.93.8.59 - 174
Administr - 9

Top ISPs:
DigitalOcean, LLC - 525
Datacamp Limited - 48
Charter Communications - 42

Top Clients:
Unknown - 840

Top Software:
Unknown - 840

Top Keyboards:
Unknown - 840

Top IP Classification:
hosting - 609
Unknown - 171
hosting & proxy - 60

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

2026-01-23 RDP #Honeypot IOCs - 560 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
134.199.198.215 - 330
37.19.198.89 - 32
47.25.7.101 - 28

Top ASNs:
AS14061 - 350
AS212238 - 32
AS20115 - 28

Top Accounts:
hello - 410
142.93.8.59 - 116
Administr - 6

Top ISPs:
DigitalOcean, LLC - 350
Datacamp Limited - 32
Charter Communications - 28

Top Clients:
Unknown - 560

Top Software:
Unknown - 560

Top Keyboards:
Unknown - 560

Top IP Classification:
hosting - 406
Unknown - 114
hosting & proxy - 40

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

2026-01-23 RDP #Honeypot IOCs - 280 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
134.199.198.215 - 165
37.19.198.89 - 16
47.25.7.101 - 14

Top ASNs:
AS14061 - 175
AS212238 - 16
AS20115 - 14

Top Accounts:
hello - 205
142.93.8.59 - 58
Administr - 3

Top ISPs:
DigitalOcean, LLC - 175
Datacamp Limited - 16
Charter Communications - 14

Top Clients:
Unknown - 280

Top Software:
Unknown - 280

Top Keyboards:
Unknown - 280

Top IP Classification:
hosting - 203
Unknown - 57
hosting & proxy - 20

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

Fortinet is analyzing SSO abuse on FortiOS, with reports showing admin access via SAML even on fully patched releases.

The situation reinforces long-standing concerns around identity exposure on edge devices and the need for strict access controls alongside patching.

How are you handling SSO risk in firewall and gateway environments?

Source: https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios?lctg=330010614

Comment, share insights, and follow @technadu for practitioner-focused security updates.

#InfoSec #Fortinet #SSO #NetworkSecurity #IAM #BlueTeam #CyberDefense

2026-01-22 RDP #Honeypot IOCs - 462 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
134.199.198.215 - 144
47.25.7.101 - 51
222.121.204.112 - 42

Top ASNs:
AS14061 - 180
AS20115 - 51
AS4766 - 42

Top Accounts:
hello - 270
142.93.8.59 - 87
Administr - 21

Top ISPs:
DigitalOcean, LLC - 180
Charter Communications - 51
Korea Telecom - 42

Top Clients:
Unknown - 462

Top Software:
Unknown - 462

Top Keyboards:
Unknown - 462

Top IP Classification:
hosting - 249
Unknown - 189
hosting & proxy - 24

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

2026-01-22 RDP #Honeypot IOCs - 308 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
134.199.198.215 - 96
47.25.7.101 - 34
222.121.204.112 - 28

Top ASNs:
AS14061 - 120
AS20115 - 34
AS4766 - 28

Top Accounts:
hello - 180
142.93.8.59 - 58
Administr - 14

Top ISPs:
DigitalOcean, LLC - 120
Charter Communications - 34
Korea Telecom - 28

Top Clients:
Unknown - 308

Top Software:
Unknown - 308

Top Keyboards:
Unknown - 308

Top IP Classification:
hosting - 166
Unknown - 126
hosting & proxy - 16

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

2026-01-22 RDP #Honeypot IOCs - 154 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
134.199.198.215 - 48
47.25.7.101 - 17
222.121.204.112 - 14

Top ASNs:
AS14061 - 60
AS20115 - 17
AS4766 - 14

Top Accounts:
hello - 90
142.93.8.59 - 29
Administr - 7

Top ISPs:
DigitalOcean, LLC - 60
Charter Communications - 17
Korea Telecom - 14

Top Clients:
Unknown - 154

Top Software:
Unknown - 154

Top Keyboards:
Unknown - 154

Top IP Classification:
hosting - 83
Unknown - 63
hosting & proxy - 8

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

New by me: 20 Common Network Ports You Must Know (and Secure)

If you can’t explain why a port is open, close it. If it’s a management port, never put it on the public internet. This post covers the 20 ports I see constantly in MSP and security work, plus how to lock them down without breaking the business. Printable cheat sheet included.

https://www.kylereddoch.me/blog/20-common-network-ports-you-must-know-and-secure/

#Cybersecurity #Infosec #Networking #BlueTeam #RDP #SMB #DNS #Hardening

2026-01-21 RDP #Honeypot IOCs - 261 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
47.25.7.101 - 39
86.122.108.113 - 33
37.19.198.89 - 24

Top ASNs:
AS20115 - 39
AS396982 - 36
AS8708 - 33

Top Accounts:
142.93.8.59 - 117
hello - 39
admin - 27

Top ISPs:
Charter Communications - 39
Google LLC - 36
RCS & RDS - 33

Top Clients:
Unknown - 261

Top Software:
Unknown - 261

Top Keyboards:
Unknown - 261

Top IP Classification:
Unknown - 159
hosting - 78
hosting & proxy - 24

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

2026-01-21 RDP #Honeypot IOCs - 174 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
47.25.7.101 - 26
86.122.108.113 - 22
37.19.198.89 - 16

Top ASNs:
AS20115 - 26
AS396982 - 24
AS8708 - 22

Top Accounts:
142.93.8.59 - 78
hello - 26
admin - 18

Top ISPs:
Charter Communications - 26
Google LLC - 24
RCS & RDS - 22

Top Clients:
Unknown - 174

Top Software:
Unknown - 174

Top Keyboards:
Unknown - 174

Top IP Classification:
Unknown - 106
hosting - 52
hosting & proxy - 16

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

2026-01-21 RDP #Honeypot IOCs - 87 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
47.25.7.101 - 13
86.122.108.113 - 11
37.19.198.89 - 8

Top ASNs:
AS20115 - 13
AS396982 - 12
AS8708 - 11

Top Accounts:
142.93.8.59 - 39
hello - 13
admin - 9

Top ISPs:
Charter Communications - 13
Google LLC - 12
RCS & RDS - 11

Top Clients:
Unknown - 87

Top Software:
Unknown - 87

Top Keyboards:
Unknown - 87

Top IP Classification:
Unknown - 53
hosting - 26
hosting & proxy - 8

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

CVE-2026-0500 in SAP Wily Introscope Enterprise Manager (CVSS 9.6) enables near‑frictionless remote code execution against monitoring infrastructure with minimal user interaction.

https://www.cvedatabase.com/cve/CVE-2026-0500

#CyberSecurity #SAP #RCE #Monitoring #BlueTeam #CVE20260500

2026-01-20 RDP #Honeypot IOCs - 264 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
222.121.204.112 - 45
47.25.7.101 - 21
51.77.207.22 - 21

Top ASNs:
AS4766 - 45
AS396982 - 36
AS14061 - 30

Top Accounts:
142.93.8.59 - 105
hello - 57
root - 18

Top ISPs:
Korea Telecom - 45
Google LLC - 36
DigitalOcean, LLC - 30

Top Clients:
Unknown - 264

Top Software:
Unknown - 264

Top Keyboards:
Unknown - 264

Top IP Classification:
Unknown - 162
hosting - 90
mobile - 9

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

2026-01-20 RDP #Honeypot IOCs - 176 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
222.121.204.112 - 30
47.25.7.101 - 14
51.77.207.22 - 14

Top ASNs:
AS4766 - 30
AS396982 - 24
AS14061 - 20

Top Accounts:
142.93.8.59 - 70
hello - 38
root - 12

Top ISPs:
Korea Telecom - 30
Google LLC - 24
DigitalOcean, LLC - 20

Top Clients:
Unknown - 176

Top Software:
Unknown - 176

Top Keyboards:
Unknown - 176

Top IP Classification:
Unknown - 108
hosting - 60
mobile - 6

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

2026-01-20 RDP #Honeypot IOCs - 88 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
222.121.204.112 - 15
47.25.7.101 - 7
51.77.207.22 - 7

Top ASNs:
AS4766 - 15
AS396982 - 12
AS14061 - 10

Top Accounts:
142.93.8.59 - 35
hello - 19
root - 6

Top ISPs:
Korea Telecom - 15
Google LLC - 12
DigitalOcean, LLC - 10

Top Clients:
Unknown - 88

Top Software:
Unknown - 88

Top Keyboards:
Unknown - 88

Top IP Classification:
Unknown - 54
hosting - 30
mobile - 3

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

Honeypot Chronicles: The Degradation of Effort

- Day 1: "Interesting, they're trying 'admin', 'root', 'ubnt'... someone did their homework"
- Day 7: "Okay, 'pi', 'oracle', 'support'... still tracking common defaults"
- Day 30: "They're trying 'test' and '123456'... effort is declining"
- Today: Username: "1"

My honeypots have broken them. They've given up. They're just typing random keys now. Next week I expect to see username: "asdfghjkl" with password: "cat walked across keyboard"

This is what happens when a botnet runs out of wordlists and starts improvising like a college student who didn't study for the quiz. 🤦‍♀️

#Cybersecurity #infosec #honeypot #blueteam @sashatheflamingo

2026-01-19 RDP #Honeypot IOCs - 189 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
47.25.7.101 - 27
51.77.207.22 - 15
171.50.172.27 - 15

Top ASNs:
AS20115 - 27
AS396982 - 27
AS16276 - 15

Top Accounts:
142.93.8.59 - 99
hello - 18
Administr - 15

Top ISPs:
Charter Communications - 27
Google LLC - 27
OVH SAS - 15

Top Clients:
Unknown - 189

Top Software:
Unknown - 189

Top Keyboards:
Unknown - 189

Top IP Classification:
Unknown - 114
hosting - 63
mobile - 12

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

2026-01-19 RDP #Honeypot IOCs - 126 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
47.25.7.101 - 18
51.77.207.22 - 10
171.50.172.27 - 10

Top ASNs:
AS20115 - 18
AS396982 - 18
AS16276 - 10

Top Accounts:
142.93.8.59 - 66
hello - 12
Administr - 10

Top ISPs:
Charter Communications - 18
Google LLC - 18
OVH SAS - 10

Top Clients:
Unknown - 126

Top Software:
Unknown - 126

Top Keyboards:
Unknown - 126

Top IP Classification:
Unknown - 76
hosting - 42
mobile - 8

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

2026-01-19 RDP #Honeypot IOCs - 63 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
47.25.7.101 - 9
51.77.207.22 - 5
171.50.172.27 - 5

Top ASNs:
AS20115 - 9
AS396982 - 9
AS16276 - 5

Top Accounts:
142.93.8.59 - 33
hello - 6
Administr - 5

Top ISPs:
Charter Communications - 9
Google LLC - 9
OVH SAS - 5

Top Clients:
Unknown - 63

Top Software:
Unknown - 63

Top Keyboards:
Unknown - 63

Top IP Classification:
Unknown - 38
hosting - 21
mobile - 4

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

2026-01-18 RDP #Honeypot IOCs - 225 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
222.121.204.112 - 45
47.25.7.101 - 39
159.223.88.130 - 30

Top ASNs:
AS4766 - 45
AS20115 - 39
AS14061 - 30

Top Accounts:
142.93.8.59 - 96
hello - 93
GIDwatAre - 3

Top ISPs:
Korea Telecom - 45
Charter Communications - 39
DigitalOcean, LLC - 30

Top Clients:
Unknown - 225

Top Software:
Unknown - 225

Top Keyboards:
Unknown - 225

Top IP Classification:
Unknown - 153
hosting - 63
mobile - 6

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security