Honeypot Threat Analysis — September 29, 2026
Critical threat level — massive coordinated attack activity across all honeypot services.
Cybersecurity Analysis for September 29, 2026
Overview:
On September 29, 2026, the honeypot network at honey-ai.dev experienced a significant increase in cyber activity compared to previous days. The network saw an influx of over 317 attackers attempting various exploits and probing activities through SSH, HTTP, and other protocols.
Detailed Analysis:
SSH Activity:
The primary focus on September 29 was the SSH connection attempt (conn/288) and login attempts (logins/199). The number of commands executed (cmds/152) also increased to 152. This suggests a shift in attackers’ tactics, possibly targeting more complex or specific vulnerabilities.
Multi-Protocol Activity:
The network observed an increase in multi-protocol activity with over 3403 events logged from 140 IPs. The primary protocols were FTP (688), Telnet (592), SMTP (798), MySQL (396), Redis (183), Git (256), VNC (72), and RDP (58). This indicates a diversified approach by attackers, targeting multiple services simultaneously.
HTTP Activity:
HTTP traffic was the second most active protocol with 44 requests from 25 IPs. The HTTP paths observed included “/SDK/webLanguage”, “/hachk.php”, “/v1/models”, and “/api/json”. This suggests that some attackers were testing specific endpoints or services for potential vulnerabilities.
IDS Alerts:
The Intrusion Detection System (IDS) reported 4208 alerts from 480 IPs, with the majority of alerts being classified as critical. The high number of alerts indicates an increase in suspicious activity and a need to enhance the network’s monitoring capabilities.
Geographic Analysis:
Geographically, the top three countries contributing the most were United States (993), China (303), and Germany (264). This suggests that these regions continue to be significant sources for cybercriminals looking for vulnerabilities in specific locations. The Netherlands (125) also contributed significantly with 125 IP addresses.
Top IPs:
The top five IPs involved in the attacks were “123.135.77.238”, “175.107.2.168”, “175.107.1.199”, “139.135.60.50”, and “139.135.60.84”. These IPs are likely the primary targets of attackers who are using these locations for their attacks.
Top Passwords:
The most common passwords used were “aad3f9ba1d6740cc” (22 times), “91566946b1d8deb0” (19 times), “8c6976e5b5410415” (16 times), “0d6be69b264717f2” (13 times), and “ef92b778bafe771e” (11 times). These passwords are commonly used to bypass basic security measures, making them a significant concern for network administrators.
HTTP Paths:
The most frequently hit paths on the honeypot were “/SDK/webLanguage”, “/hachk.php”, “/v1/models”, and “/api/json”. This indicates that attackers might be testing specific endpoints or services for potential vulnerabilities rather than targeting random files. The presence of these paths suggests a level of sophistication in their attack methods.
Malware:
There was no malware captured during the day, which is concerning given the high number of suspicious connections and attempts. The lack of malware could indicate that attackers were more focused on exploiting specific weaknesses or avoiding detection by antivirus software.
Tarpit Situation:
The network experienced 23 connections being tarpitted (trapped), but no significant waste of time was observed in this incident, indicating successful interception without further complications.
Malware and Backfire Scans:
There were no malware captured on the honeypot network. The lack of reported malware suggests that attackers might be using alternative methods or avoiding detection, possibly due to increased security measures.
MCP Trap:
The network had 4 requests from 1 IP (172.86.112.198) with a user-agent string indicating the use of Boto3/1.40.61 and Botocore#1.40.61, pointing to an attempt at unauthorized access using AWS credentials.
Portscans:
No successful port scans were detected by the network’s tools during this period, suggesting that attackers might be avoiding common vulnerabilities or testing for specific services rather than scanning extensively.
AI Defense:
The honeypot successfully blocked 3 out of 22 canarytoken triggers and all injection attempts. This indicates a strong defensive posture against known attack vectors used in the network.
Community Defense:
There were no notable community defense measures implemented during this period, but it is crucial to note that these are not necessarily associated with any specific incident reported here.
Conclusion:
The security landscape on September 29, 2026, at honey-ai.dev was characterized by a high volume of SSH connections and login attempts, combined with sophisticated HTTP requests testing various services. The lack of malware captures suggests a focus on exploiting known vulnerabilities rather than launching attacks. Despite the robust IDS alerts, there were no reported instances of backfire scans or targeted exploits. This data highlights the importance of continuing to monitor and enhance security measures in response to emerging threats.
Note:
This analysis is based on collected data from September 29, 2026, and is provided for informational purposes only.
Pi5/Spain/open-source
- Data Source: Honey AI.dev
- Report Created: September 30, 2026
This analysis was generated by qwen2.5:1.5b running locally on the Raspberry Pi 5 honeypot lab. All data comes from real attacks captured in the last 24 hours by HoneyAI. View the raw data report for complete metrics.