Mmastodon TechnologyCybersecurity first seen 6 h ago, last 6 h ago, peak #11
Honeypot logs flag 147 RDP scans with new IOCs
Original: 2026-10-12 RDP # Honeypot IOCs - 147 scans Thread with top 3 features in each category and links to the full dataset # D
Security researchers have published indicators of compromise from an RDP honeypot covering 147 scans recorded on 12 October 2026. The dataset highlights the most active source IP addresses, led by 104.196.118.248 with 13 scans, the busiest networks including AS396982 with 55 scans, and commonly attempted account names such as 'hello'. Full data and per-category breakdowns are shared for defenders to block and investigate.
Why now: Blue-team and threat-intelligence communities routinely share fresh IOC data so defenders can update blocklists and spot active scanning campaigns.
RDP honeypot104.196.118.248AS396982infosec.exchange
Evidence
- 2026-10-12 RDP # Honeypot IOCs - 147 scans Thread with top 3 features in each category and links to the full dataset # DFIR # InfoSec Top IPs: 104.196.118.248 - 13 34.170.147.105 - 12 136.66.0.167 - 12 Top ASNs: AS396982 - 55 AS10439 - 10 AS9808 - 9 Top Accounts: hello - 64… · rdpsnitch@infosec.exchange · 2
API: https://socialmediatrends-api.osmike.com/v1/trends/2047762