Honeypot Threat Analysis — September 28, 2026
Critical threat level — massive coordinated attack activity across all honeypot services.
Threat Overview
On September 28, 2026, our Raspberry Pi 5 honeypot in Spain witnessed a significant increase in malicious activity. The day started with an overwhelming influx of 425 attackers attempting to gain unauthorized access through SSH, FTP, Telnet, SMTP, MySQL, Redis, Git, VNC, RDP, and HTTP methods.
Geographical Distribution
The majority of the attacks originated from United States (948 users) followed by China (290 users), Germany (251 users), United Kingdom (169 users), Belgium (145 users), Pakistan (131 users), Korea, Republic of (119 users), India (117 users), Netherlands (116 users), and Hong Kong (112 users). This indicates a global threat landscape with significant activity from various countries.
Top IPs and Passwords
The top 5 most active IP addresses were “218.76.254.38”, “222.100.165.19”, “39.34.188.138”, “153.117.26.173”, and “178.16.55.41”. Interestingly, the most commonly used password was “91566946b1d8deb0”.
HTTP Paths
The honeypot was compromised through multiple HTTP paths such as “/login”, “/boaform/admin/formLogin?username=user”, “/manager/html”, and “/GponForm/diag_Form?images/”. The presence of these paths suggests a targeted attack on login pages or administrative interfaces.
Tarpit and Malware
Today, our honeypot was not compromised by malware, but we did manage to trap 88 connections from 36 IP addresses. Additionally, the abuse IPs database reported 383 instances of abuse attempts.
Community Defense
Our community defense measures were effective as no threats or injections were blocked today. However, 11 leaks were detected and mitigated on our system.
Backfire Scans
There were no backfire scans observed on our honeypot, indicating that the system was not actively being used for reconnaissance purposes.
Portscans and SCP
The honeypot did not see any portscans or SCP (Secure Copy Protocol) activity. This suggests that the device is primarily focused on hosting services rather than engaging in network scanning.
AI Defense
Our automated defense systems were able to block 0 injections, but there was a successful leak blocked today.
Threat Overview and Reporting
The day’s threat overview highlights the significant increase in cyberattacks against our honeypot. The geographic distribution suggests a wide-ranging threat landscape with potential for further targeted attacks. The top IPs, passwords, HTTP paths, tarpit traps, and community defense measures provide valuable insights into the nature of these activities.
Conclusion
While our honeypot is designed to detect and respond to cyber threats, it’s clear that we’re dealing with a complex and evolving threat landscape. Continued vigilance and improvement in our security protocols will be essential as we navigate this growing digital challenge.
This analysis was generated by qwen2.5:1.5b running locally on the Raspberry Pi 5 honeypot lab. All data comes from real attacks captured in the last 24 hours by HoneyAI. View the raw data report for complete metrics.