Mmastodon TechnologyCybersecurity first seen 18 h ago, last 18 h ago, peak #12
RDP honeypot publishes indicators from 92 scans
Original: 2026-10-03 RDP # Honeypot IOCs - 92 scans Thread with top 3 features in each category and links to the full dataset # DF
A cybersecurity researcher has published indicators of compromise gathered from an RDP honeypot over 2026-10-03, covering 92 scans. The most active source IPs were 94.26.68.55 and 94.26.68.54, with 13 scans each, and AS201814 topped the hosting networks. The account name 'hello' was the most attempted login. Full data has been shared so defenders can block the addresses.
Why now: Security teams monitoring RDP exposure are sharing fresh indicators of compromise to help block the listed addresses.
rdpsnitchAS20181494.26.68.55RDP honeypot
Evidence
- 2026-10-03 RDP # Honeypot IOCs - 92 scans Thread with top 3 features in each category and links to the full dataset # DFIR # InfoSec Top IPs: 94.26.68.55 - 13 94.26.68.54 - 13 103.180.212.8 - 10 Top ASNs: AS201814 - 28 AS396982 - 16 AS151734 - 10 Top Accounts: hello - 40… · rdpsnitch@infosec.exchange · 2
API: https://socialmediatrends-api.osmike.com/v1/trends/921821