Mmastodon TechnologyCybersecurity first seen 12 h ago, last 12 h ago, peak #11
RDP honeypot logs 302 scans in daily threat report
Original: 2026-10-07 RDP # Honeypot IOCs - 302 scans Thread with top 3 features in each category and links to the full dataset # D
A daily threat report dated October 7, 2026 has published indicators of compromise from an RDP honeypot, covering 302 scans. The most active source IPs listed are 156.225.17.60 with 56 scans, 109.49.210.201 with 24, and 172.232.240.202 with 20. The report also ranks the top autonomous systems and targeted accounts, and links to a full dataset for DFIR and InfoSec researchers.
Why now: Security practitioners follow daily honeypot IOC releases to block newly active scanning infrastructure.
156.225.17.60109.49.210.201172.232.240.202AS401696
Evidence
- 2026-10-07 RDP # Honeypot IOCs - 302 scans Thread with top 3 features in each category and links to the full dataset # DFIR # InfoSec Top IPs: 156.225.17.60 - 56 109.49.210.201 - 24 172.232.240.202 - 20 Top ASNs: AS401696 - 56 AS2860 - 24 AS396982 - 24 Top Accounts: 142.93.8.59… · rdpsnitch@infosec.exchange · 2
API: https://socialmediatrends-api.osmike.com/v1/trends/1421666