Honeypot Threat Analysis — October 21, 2026
Critical threat level — massive coordinated attack activity across all honeypot services.
Threat Overview
On 2026-10-21, the honeypot recorded 502 SSH connections, 405 successful logins, and 97 executed commands from 202 IPs. Across all services, about 372 distinct attackers were observed, and the day is classified as critical. Suricata generated 90,158 alerts from 642 IPs.
Geographic Analysis
GeoIP data covers 6,514 IPs. The United States leads with 1,956 (30%), followed by China at 539 (8%), Germany at 436 (6%), Belgium at 422 (6%), and the United Kingdom at 342 (5%). Pakistan accounts for 308 (4%), the Netherlands for 251 (3%), Hong Kong for 196 (3%), India for 176 (2%), and France for 173 (2%). Geography alone is a weak attribution signal, since many of these addresses are likely cloud hosts or relays.
SSH Brute Force
The most active source IPs were 179.189.3.196, 103.152.101.119, 72.255.18.160, 160.30.109.25, and 175.107.237.191. The most frequently attempted passwords were 91566946b1d8deb0, aad3f9ba1d6740cc, 8c6976e5b5410415, 5e884898da280471, and e0bc60c82713f64e. These values appear hash-like in the logs, so they are recorded as observed rather than confirmed plaintext.
Post-Exploitation
Attackers opened 41 TTY sessions. The dominant command, uname -s -v -n -r -m, appeared 796 times, with a further 20 runs using a /bin/./ prefix. This is consistent with automated system fingerprinting.
Two recurring persistence patterns stand out. Across 44 sessions, attackers ran chattr -ia .ssh and lockr -ia .ssh to clear immutable attributes. Another 44 sessions removed the .ssh directory, recreated it, and wrote an ssh-rsa public key into it, which grants the attacker future key-based access. Two sessions read /proc/cpuinfo to check the CPU, a common step before deciding whether a host is worth using.
Web Scanning
HTTP activity totalled 235 requests from 32 IPs. The most requested paths were /, /SDK/webLanguage, /hachk.php, /.git/config, and /.git/HEAD. The /SDK/webLanguage path is typically probed against embedded devices such as cameras and DVRs, while the /.git/ requests look for exposed repository metadata.
IDS & Scan Intel
Beyond the 90,158 Suricata alerts, multi-protocol probing produced 2,056 events from 138 IPs across FTP, Telnet, SMTP, MySQL, Redis, Git, VNC, and RDP. SNMP received 34 requests from 20 IPs.
Tarpit
The tarpit trapped 40 connections from 23 IPs, with 0 hours of attacker time wasted.
Canarytokens
Canarytokens fired 104 times. An AWS token was triggered from 168.222.244.156 using a Boto3/1.43.114 user agent on Python 3.12.15 under Linux. This indicates an automated script actively testing the planted credential.
MCP Trap
The MCP trap received 6 requests from 3 IPs. No tools were invoked.
AI Defense
Zero prompt injection attempts were blocked, and 12 data leak attempts were blocked.
Community Defense
Of the attacking IPs, 350 were reported to AbuseIPDB, contributing to shared blocklists.
This analysis comes from a Raspberry Pi 5 honeypot running in Spain. The stack is built entirely on open-source tooling, so the methodology and configuration can be reviewed and reproduced.
This analysis was generated by claude-haiku-5-5 via the Anthropic API for the Raspberry Pi 5 honeypot lab. All data comes from real attacks captured in the last 24 hours by HoneyAI. View the raw data report for complete metrics.