Honeypot Threat Analysis — October 20, 2026
Critical threat level — massive coordinated attack activity across all honeypot services.
Threat Overview
Today’s honeypot telemetry on the Raspberry Pi 5 sensor in Spain recorded roughly 240 unique attackers, with severity rated critical. SSH was the dominant surface, with 771 connections and 545 login attempts across 79 IPs. Multi-protocol listeners (FTP, Telnet, SMTP, MySQL, Redis, Git, VNC, RDP) logged 5,424 events from 130 IPs. Suricata raised 89,335 alerts involving 907 IPs. Most of this activity appears automated, with scripted credential spraying followed by fixed post-login command sets.
Geographic Analysis
Of the 6,277 IPs geolocated, the United States accounted for 30% (1,897), followed by China at 8% (503), Germany at 6% (431), and Belgium at 6% (406). The United Kingdom (5%), Pakistan (4%), the Netherlands (3%), Hong Kong (3%), France (2%), and India (2%) completed the top ten. Geography alone is a weak indicator here, since many sources are likely proxies, compromised hosts, or cloud infrastructure.
SSH Brute Force
Five IPs stood out in the SSH data: 59.57.243.139, 218.107.203.188, 117.134.199.10, 124.29.226.241, and 103.26.82.20. The most frequently attempted passwords were opaque 16-character hex strings (91566946b1d8deb0, aad3f9ba1d6740cc, 8d969eef6ecad3c2, a4de68667b226ba0, c2333a7e3a607935). Their uniformity suggests generated or harvested credential lists rather than human-chosen guesses.
Post-Exploitation
Forty-one TTY sessions were captured. The most common command was uname -s -v -n -r -m (796 executions), a standard fingerprinting step. Two behaviours deserve attention:
- SSH key persistence: 44 sessions ran
cd ~; chattr -ia .ssh; lockr -ia .ssh, clearing immutable attributes, thenrm -rf .ssh, recreating the directory, and writing an attacker-suppliedssh-rsapublic key toauthorized_keys. This is a classic backdoor-installation sequence. - Hardware reconnaissance: Smaller sets of sessions read
/proc/cpuinfoto count or identify CPU details, typically to determine whether the host is worth using for cryptomining or botnet membership.
Web Scanning
HTTP activity was light: 53 requests from 31 IPs. Requested paths included /, /SDK/webLanguage, /login, /hachk.php, and a router-style /boaform/admin/formLogin URL with injected parameters. The latter two indicate probing for known embedded-device vulnerabilities rather than general web crawling.
IDS & Scan Intel
Suricata’s 89,335 alerts from 907 IPs far exceed the number of attacking hosts, reflecting repeated signature matches per source. MSSQL drew 3,123 events from 2 IPs, and SNMP drew 44 events from 23 IPs, both consistent with targeted service enumeration.
Tarpit
The tarpit trapped 64 connections from 41 IPs, holding them without a useful response for the full session duration.
Canarytokens
Canarytokens fired 116 times. Notably, an AWS token was triggered by 168.222.244.156 using a Boto3 1.43.114 client on Python 3.12.15 under Linux. Automated SDK use against a planted credential indicates an actor programmatically testing harvested cloud keys.
MCP Trap
The MCP trap received 9 requests from 4 IPs. No tool invocations were recorded.
AI Defense
The AI defense layer blocked 12 data-leak attempts and recorded no prompt-injection attempts.
Community Defense
AbuseIPDB reports were filed for 213 of today’s attacking IPs. Sharing these reports helps other operators block repeat sources.
Honey-ai.dev runs on a Raspberry Pi 5 in Spain, using open-source honeypot and detection tooling. All data is from our own sensor and is published for community defense.
This analysis was generated by claude-haiku-5-5 via the Anthropic API for the Raspberry Pi 5 honeypot lab. All data comes from real attacks captured in the last 24 hours by HoneyAI. View the raw data report for complete metrics.