AS8075

A daily RDP honeypot report dated 6 October 2026 recorded 598 scans and published indicators of compromise for defenders. The most active source IP, 20.233.35.68, accounted for 340 scans, with AS8075 the top network. The most common account probed was 'hello'. The thread lists top indicators per category and links to the full dataset for security teams.

A honeypot operator published daily indicators of compromise from 299 RDP scans recorded on 6 October 2026. The most active source IP, 20.233.35.68, accounted for 170 scans, with network AS8075 dominating the source networks. The most common account targeted was 'hello'. The release includes links to the full dataset for defenders and incident response teams.

A daily RDP honeypot report dated 5 October 2026 logs 330 scans, publishing indicators of compromise including the most active source IPs, such as 82.85.225.167 and 50.250.207.222, and networks like AS8075 and AS8612. The report highlights the top accounts targeted and links to the full dataset for defenders.

A cybersecurity researcher has published fresh indicators of compromise drawn from an RDP honeypot, covering 220 scans recorded on 5 October 2026. The dataset highlights the most active source IP addresses, including 82.85.225.167 with 24 scans, leading autonomous systems such as AS8075, and commonly targeted accounts, with full data made publicly available for defenders and DFIR teams.

Cybersecurity researchers have published indicators of compromise drawn from an RDP honeypot, covering 110 scans recorded on October 5, 2026. The report lists the most active source IPs, including 82.85.225.167 with 12 scans, the top networks involved such as AS8075, and the most targeted accounts, with links to the full dataset for defenders.

Autonomous System 8075, the network operated by Microsoft, was observed announcing IP address space located in Oslo, Norway. The observation was logged and shared on 25 September 2026 with the cybersecurity community under the tag #shodansafari. This type of sighting is used by security researchers to track how large cloud and technology providers extend their network presence into new regions and data centre locations.