Hello and welcome to the Monday, August 4, 2025 edition of the Sands Internet Storm Center's Stormcast.

My name is Johannes Ulrich, recording today from Jacksonville, Florida.

And this episode is brought you by the Sands.edu graduate certificate program in incident response.

Nothing groundbreaking today as far as

as a storm center data goes. Well, the one little bit odd thing they had is scans for

S-H-Intelnet using the username Pop3 user and the password, well, just username or

1, 2, 3, 4, 5, 6.

Just a reminder that, well, yes, those old protocols may still be out there.

So if you no longer use Pop, make sure you don't just disable the Pop 3 server, but also,

well, remove associated accounts if possible or make sure they're at least

not able to log in because, well, given that they are probably 10 or so years old, who knows

what the password is and it may be something stupidly simple. Also interesting here, the network

where these particular scans originated from, well, it's managed by Unmanaged,

according to Who Is. That appears to be the official name of that particular network service

provider. So Unmanaged.uk. It's a UK provider, at least according to the records.

Don't think they're doing much in terms of managing abuse and the like.

These are often also some bullet-proof hosting providers.

Haven't seen this particular one before,

but often I don't really bother looking at the Who Is record.

So definitely, well, like I said, maybe just

block that particular network. Haven't really seen anything too useful in that network.

And Arctic Wolf published a blog post stating that they suspect there may be a seraday

...