Mmastodon TechnologyCybersecurity first seen 4 d ago, last 4 d ago, peak #7
RDP honeypot logs 5,068 scans with top attacker IOCs published
Original: 2026-10-10 RDP # Honeypot IOCs - 5068 scans Thread with top 3 features in each category and links to the full dataset #
An RDP honeypot recorded 5,068 scans on October 10, with indicators of compromise shared in a security community thread. The most active source, IP 192.3.154.48, accounted for 3,208 attempts, tied to AS36352. Other frequently observed networks included AS396982 and AS9808, with commonly targeted accounts also listed alongside links to the full dataset for defenders.
Why now: Cybersecurity practitioners are discussing fresh indicators of compromise to help block active RDP scanning sources.
AS36352192.3.154.48RDP honeypot
Evidence
- 2026-10-10 RDP # Honeypot IOCs - 5068 scans Thread with top 3 features in each category and links to the full dataset # DFIR # InfoSec Top IPs: 192.3.154.48 - 3208 76.185.13.48 - 42 81.31.194.72 - 42 Top ASNs: AS36352 - 3208 AS396982 - 246 AS9808 - 192 Top Accounts: hello -… · rdpsnitch@infosec.exchange · 2
API: https://socialmediatrends-api.osmike.com/v1/trends/1919640