Mmastodon TechnologyCybersecurity first seen 16 h ago, last 16 h ago, peak #12
RDP honeypot data reveals top attackers and IOCs
Original: 2026-10-07 RDP # Honeypot IOCs - 151 scans Thread with top 3 features in each category and links to the full dataset # D
Cybersecurity researchers have published fresh indicators of compromise from an RDP honeypot, covering 151 scans recorded on 7 October 2026. The report lists the most active source IPs, led by 156.225.17.60 with 28 hits, along with the top autonomous systems and targeted accounts, with links to the full dataset for defenders.
Why now: Security teams monitor shared honeypot IOCs to block active RDP scanning sources.
RDP honeypot156.225.17.60AS401696
Evidence
- 2026-10-07 RDP # Honeypot IOCs - 151 scans Thread with top 3 features in each category and links to the full dataset # DFIR # InfoSec Top IPs: 156.225.17.60 - 28 109.49.210.201 - 12 172.232.240.202 - 10 Top ASNs: AS401696 - 28 AS2860 - 12 AS396982 - 12 Top Accounts: 142.93.8.59… · rdpsnitch@infosec.exchange · 2
API: https://socialmediatrends-api.osmike.com/v1/trends/1421667