Mmastodon TechnologyCybersecurity first seen 3 d ago, last 3 d ago, peak #7
Honeypot Data Shows Surge of RDP Scans and New IOCs
Original: 2026-10-12 RDP # Honeypot IOCs - 444 scans Thread with top 3 features in each category and links to the full dataset # D
Cybersecurity researchers have published indicators of compromise drawn from an RDP honeypot that recorded 444 scans in a single day. The dataset highlights the most active source IP addresses, including 104.196.118.248, the busiest hosting networks by ASN, and commonly attempted account names such as 'hello', with full data made available for defenders to block or investigate.
Why now: Security teams routinely share fresh IOCs so they can block active scanning infrastructure targeting exposed RDP services.
RDP honeypot104.196.118.248AS396982infosec.exchange
Evidence
- 2026-10-12 RDP # Honeypot IOCs - 444 scans Thread with top 3 features in each category and links to the full dataset # DFIR # InfoSec Top IPs: 104.196.118.248 - 39 34.170.147.105 - 36 136.66.0.167 - 36 Top ASNs: AS396982 - 165 AS9808 - 30 AS10439 - 30 Top Accounts: hello - 192… · rdpsnitch@infosec.exchange · 1
API: https://socialmediatrends-api.osmike.com/v1/trends/2169214