# T-Pot Honeypot Weekly Threat Intelligence Summary: 2026-09-11 to 2026-09-18

**Reporting Window:** 2026-09-11 to 2026-09-18  
**Deployment:** T-Pot Distributed Sensor Network  
**Target Focus:** RDP (3389), SSH/Telnet (22/23), Ingress Malware Droppers  
**Generated At:** 2026-09-18 15:38:02 UTC  

---

## 1. Weekly Executive Summary

Over the 7-day monitoring window from **2026-09-11 to 2026-09-18**, the sensor array recorded substantial automated reconnaissance and intrusion traffic.

* **RDP Attack Volume**: Over **45,146** connection attempts detected across **268** unique source IPs.
* **SSH & Telnet Probes**: **75,363** events processed across **1,080** distinct attacking hosts.
* **Captured Payloads**: **33** automated ingress tool transfer(s) captured by honeypot emulators.

---

## 2. Top Remote Desktop (RDP) Threat Actors

Automated scanners continue aggressive password spraying against exposed RDP endpoints. The top attacking hosts identified during this period:

| Source IP | Country | Autonomous System (ASN) | Attempt Count | Target Profile |
| :--- | :--- | :--- | :--- | :--- |
| `149.50.115.15` | PL | AS201814 MEVSPACE sp. z o.o. | **18,867** | Automated RDP NLA Spray |
| `217.138.216.214` | DE | AS9009 M247 Europe SRL | **12,768** | Automated RDP NLA Spray |
| `104.243.39.112` | NL | AS23470 ReliableSite.Net LLC | **2,256** | Automated RDP NLA Spray |
| `147.124.222.57` | US | AS396073 Majestic Hosting Solutions, LLC | **1,420** | Automated RDP NLA Spray |
| `172.93.105.96` | US | AS23470 ReliableSite.Net LLC | **1,380** | Automated RDP NLA Spray |

### Targeted RDP Accounts
The most frequently targeted account names across incoming RDP sessions:
* **`administrator`**: 3,990 attempts
* **`Administrator`**: 1,733 attempts
* **`admin`**: 230 attempts
* **`Administrador`**: 11 attempts
* **`azureadmin`**: 10 attempts
* **`azureuser`**: 9 attempts

---

## 3. SSH & Telnet Exploitation Telemetry

### Top Attacking IPs
| Source IP | Country | Autonomous System (ASN) | Attempt Count |
| :--- | :--- | :--- | :--- |
| `109.160.32.72` | NL | AS197170 TechTies Inc. | **7,217** |
| `109.160.32.40` | NL | AS197170 TechTies Inc. | **7,217** |
| `109.160.32.30` | NL | AS197170 TechTies Inc. | **7,211** |
| `185.233.247.245` | TR | AS206119 Veganet Teknolojileri ve Hizmetleri LTD STI | **6,162** |
| `77.239.124.208` | NL | AS198364 BANATSYNC SRL | **4,482** |

### Targeted SSH/Telnet Credentials
Common authentication pairs observed:
* **`root`**: 3,037 login attempts
* **`admin`**: 663 login attempts
* **`ubuntu`**: 285 login attempts
* **`user`**: 272 login attempts
* **`deploy`**: 160 login attempts
* **`test`**: 150 login attempts

---

## 4. Captured Ingress Malware & Payloads

The honeypot captured 33 malicious staging script(s) dropped via shell access during this window:

* **SHA-256**: `ae8d459595257f2f22c9d1ff74c4fb8a91643fad7899b57556496716692b904e`
  * **Source IP**: `130.12.180.51`
  * **Download URL**: `None`
  * **Timestamp**: `2026-09-12T02:43:55.520978+00:00`

* **SHA-256**: `0db4656687a425c47d19000db866db52c7e415dbfaf6b5c651adcb9275ab23ca`
  * **Source IP**: `130.12.180.51`
  * **Download URL**: `None`
  * **Timestamp**: `2026-09-12T02:43:55.521557+00:00`

* **SHA-256**: `ae8d459595257f2f22c9d1ff74c4fb8a91643fad7899b57556496716692b904e`
  * **Source IP**: `130.12.180.51`
  * **Download URL**: `None`
  * **Timestamp**: `2026-09-12T02:59:25.264467+00:00`


---

## 5. Defensive Mitigations & IoCs

1. **Firewall Blocking**: Block all incoming traffic from the top offending autonomous systems and subnets identified above.
2. **Eliminate Public RDP Exposure**: Place RDP access strictly behind an authenticated VPN or Cloudflare Zero Trust / WireGuard gateway.
3. **Disable Telnet & Default Accounts**: Ensure port 23 is closed at perimeter firewalls and disable default accounts (`root`, `admin`, `guest`).