home.social

#soc — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #soc, aggregated by home.social.

  1. RDP Snitch @[email protected]

    2026-11-14 RDP #Honeypot IOCs - 2610 scans
    Thread with top 3 features in each category and links to the full dataset
    #DFIR #InfoSec

    Top IPs:
    45.77.247.215 - 819
    45.32.188.171 - 585
    82.223.35.19 - 108

    Top ASNs:
    AS20473 - 1497
    AS8560 - 471
    AS8075 - 162

    Top Accounts:
    probe - 1497
    142.93.8.59 - 996
    hello - 18

    Top ISPs:
    The Constant Company - 903
    Choopa - 585
    arsys.es - 411

    Top Clients:
    Unknown - 2610

    Top Software:
    Unknown - 2610

    Top Keyboards:
    Unknown - 2610

    Top IP Classification:
    hosting - 1527
    hosting & proxy - 603
    Unknown - 459

    Pastebin links with full 24-hr RDP Honeypot IOC Lists:
    Bad API request, invalid api_dev_key

    #CyberSec #SOC #Blueteam #SecOps #Security

    #honeypot #dfir #infosec #cybersec #soc #blueteam
  2. RDP Snitch @[email protected]

    2026-11-14 RDP #Honeypot IOCs - 1740 scans
    Thread with top 3 features in each category and links to the full dataset
    #DFIR #InfoSec

    Top IPs:
    45.77.247.215 - 546
    45.32.188.171 - 390
    82.223.35.19 - 72

    Top ASNs:
    AS20473 - 998
    AS8560 - 314
    AS8075 - 108

    Top Accounts:
    probe - 998
    142.93.8.59 - 664
    hello - 12

    Top ISPs:
    The Constant Company - 602
    Choopa - 390
    arsys.es - 274

    Top Clients:
    Unknown - 1740

    Top Software:
    Unknown - 1740

    Top Keyboards:
    Unknown - 1740

    Top IP Classification:
    hosting - 1018
    hosting & proxy - 402
    Unknown - 306

    Pastebin links with full 24-hr RDP Honeypot IOC Lists:
    Bad API request, invalid api_dev_key

    #CyberSec #SOC #Blueteam #SecOps #Security

    #honeypot #dfir #infosec #cybersec #soc #blueteam
  3. RDP Snitch @[email protected]

    2026-11-14 RDP #Honeypot IOCs - 870 scans
    Thread with top 3 features in each category and links to the full dataset
    #DFIR #InfoSec

    Top IPs:
    45.77.247.215 - 273
    45.32.188.171 - 195
    82.223.35.19 - 36

    Top ASNs:
    AS20473 - 499
    AS8560 - 157
    AS8075 - 54

    Top Accounts:
    probe - 499
    142.93.8.59 - 332
    hello - 6

    Top ISPs:
    The Constant Company - 301
    Choopa - 195
    arsys.es - 137

    Top Clients:
    Unknown - 870

    Top Software:
    Unknown - 870

    Top Keyboards:
    Unknown - 870

    Top IP Classification:
    hosting - 509
    hosting & proxy - 201
    Unknown - 153

    Pastebin links with full 24-hr RDP Honeypot IOC Lists:
    Bad API request, invalid api_dev_key

    #CyberSec #SOC #Blueteam #SecOps #Security

    #honeypot #dfir #infosec #cybersec #soc #blueteam
  4. RDP Snitch @[email protected]

    2026-11-13 RDP #Honeypot IOCs - 2232 scans
    Thread with top 3 features in each category and links to the full dataset
    #DFIR #InfoSec

    Top IPs:
    149.28.160.84 - 690
    149.248.5.194 - 270
    155.138.138.51 - 171

    Top ASNs:
    AS20473 - 1131
    AS8560 - 471
    AS8075 - 120

    Top Accounts:
    probe - 1131
    142.93.8.59 - 969
    hello - 42

    Top ISPs:
    The Constant Company - 1131
    arsys.es - 372
    CNC Group CHINA169 Jiangsu Province Network - 105

    Top Clients:
    Unknown - 2232

    Top Software:
    Unknown - 2232

    Top Keyboards:
    Unknown - 2232

    Top IP Classification:
    hosting - 1026
    hosting & proxy - 693
    Unknown - 486

    Pastebin links with full 24-hr RDP Honeypot IOC Lists:
    Bad API request, invalid api_dev_key

    #CyberSec #SOC #Blueteam #SecOps #Security

    #honeypot #dfir #infosec #cybersec #soc #blueteam
  5. RDP Snitch @[email protected]

    2026-11-13 RDP #Honeypot IOCs - 1488 scans
    Thread with top 3 features in each category and links to the full dataset
    #DFIR #InfoSec

    Top IPs:
    149.28.160.84 - 460
    149.248.5.194 - 180
    155.138.138.51 - 114

    Top ASNs:
    AS20473 - 754
    AS8560 - 314
    AS8075 - 80

    Top Accounts:
    probe - 754
    142.93.8.59 - 646
    hello - 28

    Top ISPs:
    The Constant Company - 754
    arsys.es - 248
    CNC Group CHINA169 Jiangsu Province Network - 70

    Top Clients:
    Unknown - 1488

    Top Software:
    Unknown - 1488

    Top Keyboards:
    Unknown - 1488

    Top IP Classification:
    hosting - 684
    hosting & proxy - 462
    Unknown - 324

    Pastebin links with full 24-hr RDP Honeypot IOC Lists:
    Bad API request, invalid api_dev_key

    #CyberSec #SOC #Blueteam #SecOps #Security

    #honeypot #dfir #infosec #cybersec #soc #blueteam
  6. RDP Snitch @[email protected]

    2026-11-13 RDP #Honeypot IOCs - 744 scans
    Thread with top 3 features in each category and links to the full dataset
    #DFIR #InfoSec

    Top IPs:
    149.28.160.84 - 230
    149.248.5.194 - 90
    155.138.138.51 - 57

    Top ASNs:
    AS20473 - 377
    AS8560 - 157
    AS8075 - 40

    Top Accounts:
    probe - 377
    142.93.8.59 - 323
    hello - 14

    Top ISPs:
    The Constant Company - 377
    arsys.es - 124
    CNC Group CHINA169 Jiangsu Province Network - 35

    Top Clients:
    Unknown - 744

    Top Software:
    Unknown - 744

    Top Keyboards:
    Unknown - 744

    Top IP Classification:
    hosting - 342
    hosting & proxy - 231
    Unknown - 162

    Pastebin links with full 24-hr RDP Honeypot IOC Lists:
    Bad API request, invalid api_dev_key

    #CyberSec #SOC #Blueteam #SecOps #Security

    #honeypot #dfir #infosec #cybersec #soc #blueteam
  7. CrowdSec @[email protected]

    Most SIEM alerts come down to one question: is this IP dangerous, and what was it doing? That's IP reputation. Full CTI (actors, campaigns, attribution) is for investigations, and needs analysts to read it.

    3 questions to ask any IP reputation vendor:
    1. Honeypots or real production servers?
    2. Behavior (CVEs, targets, ATT&CK) or just a score?
    3. How does an IP come off the list?

    crowdsec.net/blog/ip-reputatio

    #threatintel #infosec #SOC

    #threatintel #infosec #soc
  8. RDP Snitch @[email protected]

    2026-11-12 RDP #Honeypot IOCs - 2544 scans
    Thread with top 3 features in each category and links to the full dataset
    #DFIR #InfoSec

    Top IPs:
    45.32.201.22 - 1260
    82.223.17.218 - 93
    82.223.10.125 - 93

    Top ASNs:
    AS20473 - 1260
    AS8560 - 468
    AS8075 - 231

    Top Accounts:
    probe - 1260
    142.93.8.59 - 1074
    hello - 93

    Top ISPs:
    Choopa - 1260
    arsys.es - 387
    Microsoft Corporation - 168

    Top Clients:
    Unknown - 2544

    Top Software:
    Unknown - 2544

    Top Keyboards:
    Unknown - 2544

    Top IP Classification:
    hosting - 1938
    Unknown - 483
    mobile - 108

    Pastebin links with full 24-hr RDP Honeypot IOC Lists:
    Bad API request, invalid api_dev_key

    #CyberSec #SOC #Blueteam #SecOps #Security

    #honeypot #dfir #infosec #cybersec #soc #blueteam
  9. RDP Snitch @[email protected]

    2026-11-12 RDP #Honeypot IOCs - 1696 scans
    Thread with top 3 features in each category and links to the full dataset
    #DFIR #InfoSec

    Top IPs:
    45.32.201.22 - 840
    82.223.17.218 - 62
    82.223.10.125 - 62

    Top ASNs:
    AS20473 - 840
    AS8560 - 312
    AS8075 - 154

    Top Accounts:
    probe - 840
    142.93.8.59 - 716
    hello - 62

    Top ISPs:
    Choopa - 840
    arsys.es - 258
    Microsoft Corporation - 112

    Top Clients:
    Unknown - 1696

    Top Software:
    Unknown - 1696

    Top Keyboards:
    Unknown - 1696

    Top IP Classification:
    hosting - 1292
    Unknown - 322
    mobile - 72

    Pastebin links with full 24-hr RDP Honeypot IOC Lists:
    Bad API request, invalid api_dev_key

    #CyberSec #SOC #Blueteam #SecOps #Security

    #honeypot #dfir #infosec #cybersec #soc #blueteam
  10. RDP Snitch @[email protected]

    2026-11-12 RDP #Honeypot IOCs - 848 scans
    Thread with top 3 features in each category and links to the full dataset
    #DFIR #InfoSec

    Top IPs:
    45.32.201.22 - 420
    82.223.17.218 - 31
    82.223.10.125 - 31

    Top ASNs:
    AS20473 - 420
    AS8560 - 156
    AS8075 - 77

    Top Accounts:
    probe - 420
    142.93.8.59 - 358
    hello - 31

    Top ISPs:
    Choopa - 420
    arsys.es - 129
    Microsoft Corporation - 56

    Top Clients:
    Unknown - 848

    Top Software:
    Unknown - 848

    Top Keyboards:
    Unknown - 848

    Top IP Classification:
    hosting - 646
    Unknown - 161
    mobile - 36

    Pastebin links with full 24-hr RDP Honeypot IOC Lists:
    Bad API request, invalid api_dev_key

    #CyberSec #SOC #Blueteam #SecOps #Security

    #honeypot #dfir #infosec #cybersec #soc #blueteam
  11. Habr @[email protected]

    Public talk про карьеру в ИБ для студентов

    Привет, Хабр! 26 ноября проведем офлайн-ивент «CyberTeam public talk: Blue х Red» для студентов. Вместе с экспертами разберем плюсы и минусы разных карьерных треков, сравним работу в Blue и Red командах и обсудим, как не потеряться среди множества ролей. После — попрактикуемся проходить собесы, поедим пиццу и разыграем мерч. Регистрируйтесь и добавляйте в календарь ;)

    habr.com/ru/companies/k2tech/a

    #soc #защита #студентам #пентест #red_team #blue_team

    #blue_team #red_team #пентест #студентам #защита #soc
  12. Habr @[email protected]

    Кейс RED Security: как отличить ИИ от человека в автоматизированной кибератаке

    Хабр, привет! На связи Никита Полосухин, ведущий аналитик центра мониторинга и реагирования на кибератаки RED Security SOC. В этом посте расскажу о недавней атаке на крупную российскую коммерческую компанию. В расследовании атаки участвовала наша команда. Атакующий прошел через цепочку уязвимостей внешнего и внутреннего периметра, полностью скомпрометировал домен организации — и все с помощью ИИ. Не буду разливать воду, сразу к делу.

    habr.com/ru/companies/ru_mts/a

    #soc #active_directory #реагирование_на_инциденты #dcsync #ииагенты #red_security #цифровая_форензика #artex #вебшеллы #автоматизированные_атаки

    #автоматизированные_атаки #вебшеллы #artex #цифровая_форензика #red_security #ииагенты
Share on Mastodon

Enter the server where you have an account.