Mmastodon TechnologyCybersecurity first seen 5 h ago, last 5 h ago, peak #10
Honeypot data logs 441 RDP scans in one day
Original: 2026-10-12 RDP # Honeypot IOCs - 441 scans Thread with top 3 features in each category and links to the full dataset # D
Security researchers have published daily indicators of compromise from an RDP honeypot, recording 441 scan attempts on 12 October 2026. The data highlights the most active source IPs, led by 104.196.118.248 with 39 scans, the busiest hosting networks, and commonly attempted account names such as 'hello'. Full datasets and per-category breakdowns were shared for defenders to blocklist and analyse.
Why now: Defenders monitor shared IOC feeds to update blocklists against active RDP scanning campaigns.
RDP honeypot104.196.118.248AS396982Infosec.ExchangeDFIR community
Evidence
- 2026-10-12 RDP # Honeypot IOCs - 441 scans Thread with top 3 features in each category and links to the full dataset # DFIR # InfoSec Top IPs: 104.196.118.248 - 39 34.170.147.105 - 36 136.66.0.167 - 36 Top ASNs: AS396982 - 165 AS10439 - 30 AS9808 - 27 Top Accounts: hello - 192… · rdpsnitch@infosec.exchange · 2
API: https://socialmediatrends-api.osmike.com/v1/trends/2047761