#blueteam — Public Fediverse posts

2026-11-14 RDP #Honeypot IOCs - 2610 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
45.77.247.215 - 819
45.32.188.171 - 585
82.223.35.19 - 108

Top ASNs:
AS20473 - 1497
AS8560 - 471
AS8075 - 162

Top Accounts:
probe - 1497
142.93.8.59 - 996
hello - 18

Top ISPs:
The Constant Company - 903
Choopa - 585
arsys.es - 411

Top Clients:
Unknown - 2610

Top Software:
Unknown - 2610

Top Keyboards:
Unknown - 2610

Top IP Classification:
hosting - 1527
hosting & proxy - 603
Unknown - 459

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

2026-11-14 RDP #Honeypot IOCs - 1740 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
45.77.247.215 - 546
45.32.188.171 - 390
82.223.35.19 - 72

Top ASNs:
AS20473 - 998
AS8560 - 314
AS8075 - 108

Top Accounts:
probe - 998
142.93.8.59 - 664
hello - 12

Top ISPs:
The Constant Company - 602
Choopa - 390
arsys.es - 274

Top Clients:
Unknown - 1740

Top Software:
Unknown - 1740

Top Keyboards:
Unknown - 1740

Top IP Classification:
hosting - 1018
hosting & proxy - 402
Unknown - 306

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

2026-11-14 RDP #Honeypot IOCs - 870 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
45.77.247.215 - 273
45.32.188.171 - 195
82.223.35.19 - 36

Top ASNs:
AS20473 - 499
AS8560 - 157
AS8075 - 54

Top Accounts:
probe - 499
142.93.8.59 - 332
hello - 6

Top ISPs:
The Constant Company - 301
Choopa - 195
arsys.es - 137

Top Clients:
Unknown - 870

Top Software:
Unknown - 870

Top Keyboards:
Unknown - 870

Top IP Classification:
hosting - 509
hosting & proxy - 201
Unknown - 153

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

2026-11-13 RDP #Honeypot IOCs - 2232 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
149.28.160.84 - 690
149.248.5.194 - 270
155.138.138.51 - 171

Top ASNs:
AS20473 - 1131
AS8560 - 471
AS8075 - 120

Top Accounts:
probe - 1131
142.93.8.59 - 969
hello - 42

Top ISPs:
The Constant Company - 1131
arsys.es - 372
CNC Group CHINA169 Jiangsu Province Network - 105

Top Clients:
Unknown - 2232

Top Software:
Unknown - 2232

Top Keyboards:
Unknown - 2232

Top IP Classification:
hosting - 1026
hosting & proxy - 693
Unknown - 486

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

2026-11-13 RDP #Honeypot IOCs - 1488 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
149.28.160.84 - 460
149.248.5.194 - 180
155.138.138.51 - 114

Top ASNs:
AS20473 - 754
AS8560 - 314
AS8075 - 80

Top Accounts:
probe - 754
142.93.8.59 - 646
hello - 28

Top ISPs:
The Constant Company - 754
arsys.es - 248
CNC Group CHINA169 Jiangsu Province Network - 70

Top Clients:
Unknown - 1488

Top Software:
Unknown - 1488

Top Keyboards:
Unknown - 1488

Top IP Classification:
hosting - 684
hosting & proxy - 462
Unknown - 324

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

2026-11-13 RDP #Honeypot IOCs - 744 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
149.28.160.84 - 230
149.248.5.194 - 90
155.138.138.51 - 57

Top ASNs:
AS20473 - 377
AS8560 - 157
AS8075 - 40

Top Accounts:
probe - 377
142.93.8.59 - 323
hello - 14

Top ISPs:
The Constant Company - 377
arsys.es - 124
CNC Group CHINA169 Jiangsu Province Network - 35

Top Clients:
Unknown - 744

Top Software:
Unknown - 744

Top Keyboards:
Unknown - 744

Top IP Classification:
hosting - 342
hosting & proxy - 231
Unknown - 162

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

2026-11-12 RDP #Honeypot IOCs - 2544 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
45.32.201.22 - 1260
82.223.17.218 - 93
82.223.10.125 - 93

Top ASNs:
AS20473 - 1260
AS8560 - 468
AS8075 - 231

Top Accounts:
probe - 1260
142.93.8.59 - 1074
hello - 93

Top ISPs:
Choopa - 1260
arsys.es - 387
Microsoft Corporation - 168

Top Clients:
Unknown - 2544

Top Software:
Unknown - 2544

Top Keyboards:
Unknown - 2544

Top IP Classification:
hosting - 1938
Unknown - 483
mobile - 108

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

2026-11-12 RDP #Honeypot IOCs - 1696 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
45.32.201.22 - 840
82.223.17.218 - 62
82.223.10.125 - 62

Top ASNs:
AS20473 - 840
AS8560 - 312
AS8075 - 154

Top Accounts:
probe - 840
142.93.8.59 - 716
hello - 62

Top ISPs:
Choopa - 840
arsys.es - 258
Microsoft Corporation - 112

Top Clients:
Unknown - 1696

Top Software:
Unknown - 1696

Top Keyboards:
Unknown - 1696

Top IP Classification:
hosting - 1292
Unknown - 322
mobile - 72

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

2026-11-12 RDP #Honeypot IOCs - 848 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
45.32.201.22 - 420
82.223.17.218 - 31
82.223.10.125 - 31

Top ASNs:
AS20473 - 420
AS8560 - 156
AS8075 - 77

Top Accounts:
probe - 420
142.93.8.59 - 358
hello - 31

Top ISPs:
Choopa - 420
arsys.es - 129
Microsoft Corporation - 56

Top Clients:
Unknown - 848

Top Software:
Unknown - 848

Top Keyboards:
Unknown - 848

Top IP Classification:
hosting - 646
Unknown - 161
mobile - 36

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

False positives cost security teams time and focus. Overly broad rules, missing context, and environment changes all generate alerts for benign activity.

Our new blog covers how to validate false positives and report security issues:

- Investigate the data behind the alert
- Correlate it with related activity across sources
- Document the evidence and the determination
- Use validated findings to refine detection logic

https://graylog.org/post/how-to-validate-false-positives-and-report-security-issues/
#Cybersecurity #InfoSec #SIEM #SecOps #BlueTeam

Barracuda Email Security Gateway: due falle corrette il 2/11 risultano sfruttate in attacchi reali.

CVE-2026-116606: bypass dell'autorizzazione senza login (serve l'Admin UI raggiungibile). CVE-2026-111560: command injection, anche su WAF, ADC, Message Archiver, WSG. In catena: root.

CISA KEV dal 10/11, scadenza FCEB 13/11. Nessun IOC pubblico.

Da fare: verificare la patch, togliere l'Admin UI da internet.

https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection

#Barracuda #infosec #blueteam