Honeypot Threat Analysis — September 15, 2026

Cybersecurity Analysis for 2026-09-15

Overview

In the month of September, 2026, we observed a significant increase in cyberattacks targeting a honeypot system running on Raspberry Pi 5 in Spain. The environment was heavily surveilled and monitored by various security tools, including Suricata IDS, which flagged over 10,900 alerts from 720 IPs, with the majority of them being critical severity.

Threat Overview

The honeypot system experienced a total of 192 attackers across 22 unique IP addresses and 3 types of protocols: SSH (156 connections/90 logins), HTTP (61 requests/34 IPs), and multi-protocol attacks like FTP, Telnet, SMTP, MySQL, Redis, Git, VNC, RDP.

The most active attack vectors were:

SSH Brute Force Attacks: 8866 events
HTTP Scans & Requests: 136 unique IP addresses

Geographic Analysis

The honeypot system’s geographical distribution is as follows:

United States: 147 (34%)
Germany: 42 (9%)
United Kingdom: 33 (7%)
Netherlands: 30 (6%)
Belgium: 23 (5%)
China: 20 (4%)
France: 14 (3%)
Iran, Islamic Republic of: 12 (2%)
Canada: 10 (2%)

This distribution reflects the global reach of cyberattacks targeting this honeypot.

SSH Brute Force

SSH brute force attacks were a significant threat. The system was compromised by 156 unique IP addresses attempting to log in with various credentials, including:

Top Passwords:
- “vice”
- “123456”
- “12345678”
- “123456789”
- “abc123”

The most active attackers were from the following IP addresses:

37.199.101.238
201.243.120.14
72.255.26.118
59.103.106.157
223.123.72.249

Post-Exploitation

Following the initial compromise, attackers attempted to escalate privileges and execute various commands:

Rootkits & Backdoors: Detected by traping 102 connections from 68 IPs
MCP Trap: Trapped 23 requests from 3 unique IP addresses using Boto3 malware.
MSSQL/SCANNER: Portscans were not reported, but multiple attempts were made to connect to MSSQL and SNMP services.

Malware

No instances of malware were detected on the honeypot system. The environment was effectively isolated with no signs of compromise or malicious activity.

Tarpit & Canarytokens

Tarpit: Trapped 102 connections from 68 IPs, indicating a well-managed network to detect and isolate potential attackers.
Canarytokens: Only 10 triggers were set up, but no attacks occurred during the observation period.

MCP Trap & Portscans

No malicious activity was detected through any of these traps.

IDS & Scan Intel

The Suricata IDS flagged over 10,900 alerts from a variety of IP addresses, indicating a high volume and complexity of attempted attacks.

Community Defense

Injection Rules: No injection attacks were blocked during the observation period.
Leak Rules: 12 leaks were detected but not acted upon due to lack of specific rules or patterns.

Conclusion

The honeypot system running on Raspberry Pi 5 in Spain experienced a significant number of cyberattacks from diverse geographical origins. While the environment was monitored and isolated effectively, several indicators suggest that the honeypot could have been compromised by determined attackers with various credentials. The analysis underscores the importance of robust security measures to detect, isolate, and respond to such threats.

Note

This report has been compiled using data collected on 2026-09-15 from a Raspberry Pi 5 honeypot in Spain. Cybersecurity analysts should ensure that their honeypots are continuously monitored and updated with the latest security measures to prevent real-world attacks.

Pi5/Spain/Open-source Note:

This report is an analysis of cybersecurity threats against a honeypot system. It serves as a reminder for network administrators to maintain vigilance and implement robust security protocols to protect valuable resources from cyberattacks.

This analysis was generated by qwen2.5:1.5b running locally on the Raspberry Pi 5 honeypot lab. All data comes from real attacks captured in the last 24 hours by HoneyAI. View the raw data report for complete metrics.