Mmastodon TechnologyCybersecurity first seen 3 h ago, last 3 h ago, peak #11
Honeypot data logs 86 RDP scans in single day
Original: 2026-09-29 RDP # Honeypot IOCs - 86 scans Thread with top 3 features in each category and links to the full dataset # DF
A honeypot monitoring project has published indicators of compromise from 86 RDP scans recorded on 29 September 2026. The most active source IPs were 80.66.83.43 and 165.227.214.128, with 12 scans each, while hosting providers AS14061 and AS396982 accounted for the top networks. Attempted logins heavily targeted the default 'Administrator' account. The dataset is shared so defenders can block the flagged addresses.
Why now: Security teams regularly follow shared IOC feeds to block active scanning sources.
rdpsnitchAS14061AS39698280.66.83.43
Evidence
- 2026-09-29 RDP # Honeypot IOCs - 86 scans Thread with top 3 features in each category and links to the full dataset # DFIR # InfoSec Top IPs: 80.66.83.43 - 12 165.227.214.128 - 12 165.232.58.4 - 8 Top ASNs: AS14061 - 28 AS396982 - 24 AS216473 - 12 Top Accounts: Administr - 20… · rdpsnitch@infosec.exchange · 1
API: https://socialmediatrends-api.osmike.com/v1/trends/420585