Mmastodon TechnologyCybersecurity first seen 7 d ago, last 7 d ago, peak #11
RDP honeypot logs 2,461 scans dominated by single IP
Original: 2026-10-18 RDP # Honeypot IOCs - 2461 scans Thread with top 3 features in each category and links to the full dataset #
A security researcher published indicators of compromise from an RDP honeypot covering 2,461 scans recorded on 18 October 2026. The data shows one source, IP 154.36.174.33 on AS979, accounting for 2,421 of the scans, with attempted logins including the username 'hello'. A full dataset and per-category highlights were shared with the DFIR and InfoSec communities for threat hunting.
Why now: Cybersecurity practitioners regularly monitor honeypot data for emerging scanning campaigns and blocklist indicators.
154.36.174.33AS979RDP honeypotInfosec Exchange
Evidence
- 2026-10-18 RDP # Honeypot IOCs - 2461 scans Thread with top 3 features in each category and links to the full dataset # DFIR # InfoSec Top IPs: 154.36.174.33 - 2421 80.66.83.43 - 5 205.210.31.199 - 3 Top ASNs: AS979 - 2421 AS396982 - 12 AS216473 - 5 Top Accounts: hello - 2430… · rdpsnitch@infosec.exchange · 1
API: https://socialmediatrends-api.osmike.com/v1/trends/2800593