Mmastodon TechnologyCybersecurity first seen 21 h ago, last 21 h ago, peak #10
New RDP honeypot data exposes top scanning sources
Original: 2026-10-05 RDP # Honeypot IOCs - 220 scans Thread with top 3 features in each category and links to the full dataset # D
A cybersecurity researcher has published fresh indicators of compromise drawn from an RDP honeypot, covering 220 scans recorded on 5 October 2026. The dataset highlights the most active source IP addresses, including 82.85.225.167 with 24 scans, leading autonomous systems such as AS8075, and commonly targeted accounts, with full data made publicly available for defenders and DFIR teams.
Why now: Security practitioners follow shared IOC feeds to block active RDP scanning sources in real time.
rdpsnitchAS8075 (Microsoft)AS8612 (Lumasys)AS7922 (Comcast)
Evidence
- 2026-10-05 RDP # Honeypot IOCs - 220 scans Thread with top 3 features in each category and links to the full dataset # DFIR # InfoSec Top IPs: 82.85.225.167 - 24 50.250.207.222 - 22 109.49.210.201 - 18 Top ASNs: AS8075 - 30 AS8612 - 24 AS7922 - 22 Top Accounts: 142.93.8.59 -… · rdpsnitch@infosec.exchange · 1
API: https://socialmediatrends-api.osmike.com/v1/trends/1172243