Since May, malware hosts have shown up in my honeypot logs, gotten hit once, and disappeared. One host broke that pattern: 217[.]60[.]195[.]113, tied to the Redtail cryptomining botnet, kept getting hit by infected bots for 22.5 days.
Between May 3 and June 3, 2026, a threat actor operating under the handle "mdrfckr" conducted a sustained SSH credential-stuffing campaign against my internet-facing SSH honeypots. The campaign deployed 3,929 successful authentication events from 1,702 unique source IPs across 32+ countries. Upon gaining access, the attacker deployed a persistent SSH public key bearing the "mdrfckr" comment - a classic botnet recruitment / persistence mechanism.