Honeypot Threat Analysis — September 14, 2026
Critical threat level — massive coordinated attack activity across all honeypot services.
2026-09-14
Threat Overview
On the evening of September 14th, 2026, a total of 188 attackers targeted the Raspberry Pi 5 honeypot system located in Spain, with a significant majority coming from the United States (31%). Germany and Belgium also contributed to this threat load. The attackers used various protocols such as SSH for login attempts, FTP/Telnet/SMTP/MySQL/Redis/Git/VNC/RDP, and exploited HTTP paths for further exploitation.
Geographical Analysis
The honeypot hosted from 212 IPs across the globe, with a predominant presence in the United States (66%) followed by Germany (23%), Netherlands (16%), Belgium (13%), China (12%), UK (11%), Hong Kong (8%), France (7%), and Pakistan (4%). The honeypot also received an influx of 9 triggers from Canarytokens, indicating a high level of activity.
SSH Brute Force
The honeypot witnessed the highest volume of login attempts with 65 connections. SSH brute force was the primary method used by attackers to gain access. Out of these, Telnet and VNC were also common protocols utilized for post-exploitation purposes.
Post-Exploitation Tactics
SSH brute force attacks are often followed by subsequent exploitation through tools like Boto3/1.43.70 to bypass security measures such as lockr (Linux file locking mechanism) and chattr (changing attributes on files). The attackers also used a variety of commands including ‘uname -s -v -n -r -m’ to check system information, and ‘cat /proc/cpuinfo grep name wc -l’, which provided insights into the CPU architecture.
Web Scanning
The honeypot received 47 HTTP requests. The attackers often exploited known vulnerabilities like SQL injection, where they used parameters such as ’?’, or by using a vulnerable library like ‘libjpeg-turbo’ to gain further access.
IDS & Scan Intel
Over 1000 alerts were generated from the Suricata Intrusion Detection System (IDS) on the day. The attackers tried various tactics including backdoor detection, malware scanning, and even targeted port scans via tools like SCP or SSH. While no malware was detected, the honeypot managed to identify the presence of ‘Boto3/1.43.70’ as part of a large list of triggers from Canarytokens.
Malware
No malware was captured during this period, indicating that the honeypot remained effective in its defenses against malicious intrusions.
Tarpit
Of the 66 connections trapped by the tarpit tool, none were exploited for malicious activities. This suggests a robust defense mechanism capable of intercepting and analyzing potential threats before they could cause harm.
MCP Trap & Portscans
No malware was detected, but there were no tarpitted connections or port scans conducted on the honeypot that day.
AI Defense
The honeypot also faced numerous injections attempts. Although 10 leak attacks were blocked successfully, a total of 796 commands were caught for abuse detection and analysis.
Community Defense
No additional tools or techniques from community defense mechanisms were encountered during this period.
Threat Overview Summary
This threat blog provides insights into the daily activity on the Raspberry Pi 5 honeypot system in Spain. The data highlights a significant number of attackers using SSH brute force, HTTP requests for exploitation, and various post-exploitation tactics like Boto3/1.43.70 and lockr. Despite these threats, the honeypot remains effective with robust IDS systems and community defense measures.
This analysis was generated by qwen2.5:1.5b running locally on the Raspberry Pi 5 honeypot lab. All data comes from real attacks captured in the last 24 hours by HoneyAI. View the raw data report for complete metrics.