Three sensors. 14.6 million connection attempts across April, May and June. And nearly half of them aimed at one port — 1433. Q2 2026 was the quarter the databases took the hits.
Scroll or use arrow keys to navigate.
Remote desktop usually leads. Not this quarter. MSSQL alone pulled 6.30 million hits — more than RDP, VNC and SSH did individually, and close to all three combined. Everything below Telnet is a rounding error.
Q1 was "Database Season." Q2 doubled down — MSSQL went from strong to dominant.
Daily connections · Apr 1 – Jun 30 (peak: 513K on 24 May)
The MSSQL flood isn't diverse. Two-thirds of it announces itself as go-mssqldb — a single Go database driver — and most of the volume comes from ten IPs in one coordinated /28.
MSSQL client library, by volume
go-mssqldb at 68% of all MSSQL logins is a tooling fingerprint — a purpose-built Go scanner, not a mix of real clients.
| Loudest IPs | Hits | |
|---|---|---|
| 119.8.10.250 | 615,243 | MSSQL |
| 104.192.6.74 | 457,319 | MSSQL |
| 180.103.117.65 | 138,822 | MSSQL |
194.113.39.0/28 — ten IPs, each firing ~423K MSSQL + ~66K RDP with near-identical volumes. Textbook coordinated infrastructure.
Combined: ~4.15M MSSQL + ~0.66M RDP = 4.81M from one /28 — roughly two-thirds of all MSSQL traffic this quarter.
The June report caught UK infrastructure lighting up. Q2 confirms it: 5.13 million attacks from the UK — 1.8× the United States and more than the next four countries put together. It climbed all quarter and never let go.
Monthly attacks by source country · Apr → Jun 2026
These are hosting-provider footprints, not home nations — VPS and bulletproof capacity spun up where the campaign infrastructure lives.
Strip the MSSQL noise and the login attempts are the usual suspects: decade-old IoT defaults, botnet identifiers posing as usernames, and a VNC list that almost never matches.
The top credential pairs are verbatim Mirai/IoT defaults — hardcoded into botnets since 2016, still in constant rotation.
xc3511, vizxv, juantech, xmhdipc — router/DVR defaults, ten years on.
1.68M probes sent null — pure port checks. The named ones aren't people; they're tool identifiers.
Backup software and scanner names, baked into the kits.
1.90M VNC handshakes; the DES response matched a known-weak password just 1.6% of the time (30,362). Those that did:
98.4% never matched the common-password list at all.
The SMB honeypots kept catching dropped files all quarter — and once the empty-length junk is thrown out, every real sample is the same executable: HackTool.RemoteExec / RemCom. The monoculture that has run for three years didn't break in Q2.
RemCom drops by sensor · Q2 2026
Sentinel is the sink — 86% of all captures, from 186K SMB events and 159K connects in Q2.
A remote-command execution tool abused as a lateral-movement payload. 1,676 identical copies written to the SMB shares this quarter — the attackers aren't diversifying, they're re-dropping the same kit.
Two other hashes appear — da39a3ee… and 8d451938… — both null-length artifacts, dropped from the count. Every non-empty file was RemCom.
~218K SMB events, ~189K connects, ~1,900 source IPs across the three nodes. Every captured file is submitted to VirusTotal.
Three live sensors shared the load, but not evenly — the Switzerland node absorbed half of everything on its own.
What the quarter asks of everyone else:
44% of the quarter. Port 1433 belongs on a private network — never a public IP.
Mirai defaults from 2016 still lead the list. Change them; use keys for SSH.
RemCom lands via open shares. Restrict SMB, alert on executable drops.
Q2 2026
Nearly one knock in two went at a database.
One Go scanner and one /28 carried the flood.
And the same binary kept landing on the share.
0
Fourteen and a half million knocks, and almost half of them at one port. Q1 named it Database Season. Q2 turned it into a siege.
Next: Q3 2026.
The OpenCanary Experience →