Mmastodon TechnologyCybersecurity first seen 9 h ago, last 9 h ago, peak #12
Honeypot logs flag 966 RDP scans and top attacker IPs
Original: 2026-10-04 RDP # Honeypot IOCs - 966 scans Thread with top 3 features in each category and links to the full dataset # D
Cybersecurity researchers published fresh indicators of compromise from an RDP honeypot, recording 966 scans in a single day. The most active source IP, 134.209.180.117, accounted for 570 attempts, with Digital Ocean's AS14061 behind the majority of traffic. Common usernames like 'hello' were probed. The thread lists the top sources per category with links to the full dataset for defenders.
Why now: Security teams monitor shared IOC feeds to block active RDP scanning sources.
RDP honeypot134.209.180.117AS14061 (Digital Ocean)Infosec.Exchange
Evidence
- 2026-10-04 RDP # Honeypot IOCs - 966 scans Thread with top 3 features in each category and links to the full dataset # DFIR # InfoSec Top IPs: 134.209.180.117 - 570 102.88.21.136 - 57 188.121.168.214 - 33 Top ASNs: AS14061 - 588 AS29465 - 57 AS8075 - 39 Top Accounts: hello -… · rdpsnitch@infosec.exchange · 1
API: https://socialmediatrends-api.osmike.com/v1/trends/1050810