Mmastodon TechnologyCybersecurity first seen 1 d ago, last 1 d ago, peak #10
Honeypot data shows nearly 600 RDP scans in one day
Original: 2026-10-08 RDP # Honeypot IOCs - 597 scans Thread with top 3 features in each category and links to the full dataset # D
A security researcher has published a new set of indicators of compromise from an RDP honeypot, covering 597 scans recorded on 8 October 2026. The dataset highlights the most active source IP addresses, autonomous systems and attempted account names, with links to the full data for defenders. The most targeted usernames include generic ones like 'hello', and several cloud provider address ranges feature prominently among scanning sources.
Why now: Defenders monitor fresh honeypot IOC feeds to block active RDP scanning infrastructure targeting exposed systems.
RDP honeypot165.232.97.161AS396982infosec.exchangeDFIR community
Evidence
- 2026-10-08 RDP # Honeypot IOCs - 597 scans Thread with top 3 features in each category and links to the full dataset # DFIR # InfoSec Top IPs: 165.232.97.161 - 36 34.170.147.105 - 36 34.82.15.211 - 36 Top ASNs: AS396982 - 252 AS14061 - 39 AS8075 - 33 Top Accounts: hello - 270… · rdpsnitch@infosec.exchange · 2
API: https://socialmediatrends-api.osmike.com/v1/trends/1549602