Honeypot Threat Analysis — October 22, 2026
Critical threat level — massive coordinated attack activity across all honeypot services.
Threat Overview
On 2026-10-22, the honey-ai.dev Raspberry Pi 5 sensor in Spain recorded roughly 453 unique attackers across SSH, multi-protocol services, HTTP, and IDS signatures. Severity for the day is rated critical, driven mainly by SSH post-authentication activity and the volume of Suricata alerts. Of the attacking addresses, 420 have been reported to AbuseIPDB.
Geographic Analysis
GeoIP attribution covers 6,838 IPs. The United States accounts for 2,026 (29%), followed by China with 599 (8%), Belgium with 440 (6%), and Germany with 438 (6%). The United Kingdom contributed 350 (5%), Pakistan 319 (4%), and the Netherlands 257 (3%). Hong Kong, India, and the Republic of Korea each contributed 2% (201, 193, and 185 respectively).
Geographic origin is a weak indicator on its own, since many of these hosts are likely relays, cloud instances, or compromised machines.
SSH Brute Force
The SSH service logged 620 connections, 522 successful logins, and 98 executed commands from 272 source IPs. The most active sources were 221.179.76.86, 42.6.201.210, 185.234.229.7, 111.92.157.241, and 103.74.21.76.
The most frequently recorded password values are hash-like strings (aad3f9ba1d6740cc, 91566946b1d8deb0, 4813494d137e1631, 28efb68dcba507ec, 9f86d081884c7d65). They may reflect automated tooling or logging artifacts and have not been independently verified as plaintext credentials.
Post-Exploitation
Across 41 TTY sessions, the captured commands fall into three patterns:
- Reconnaissance:
uname -s -v -n -r -mwas run 796 times, plus 20 runs via/bin/./uname, indicating scripted host fingerprinting. - Persistence: 44 sessions ran
chattr -ia .ssh, removed the existing.sshdirectory, recreated it, and wrote an attacker-suppliedssh-rsapublic key toauthorized_keys. This is a classic method for retaining access that survives password changes. - Hardware profiling: Two sessions read
/proc/cpuinfoto count and identify CPU cores.
Web Scanning
HTTP traffic totalled 79 requests from 46 IPs. Requested paths included /, /hachk.php, /SDK/webLanguage, /v1/models, and a /boaform/admin/formLogin request with credential parameters. These paths target known router, camera, and LLM-service endpoints, suggesting broad, signature-based scanning.
IDS & Scan Intel
Suricata generated 89,992 alerts from 702 IPs. Multi-protocol services (FTP, Telnet, SMTP, MySQL, Redis, Git, VNC, RDP) logged 5,547 events from 135 IPs. MSSQL recorded 2,695 events from one IP, and SNMP recorded 43 events from 18 IPs. Backfire generated no scans and no open targets.
Tarpit
The tarpit trapped 60 connections from 34 IPs. No time was wasted on attackers (0h), so the tarpit did not delay these clients in a measurable way.
Canarytokens
Canarytokens fired 102 times. One AWS token was triggered from 168.222.244.156 using a Boto3 user agent on Python 3.12.15 running on Linux. This indicates automated tooling interacting with the token, consistent with an attacker testing harvested cloud credentials.
MCP Trap
The MCP trap received 6 requests from 3 IPs. No tools were invoked.
AI Defense
The AI defense layer blocked 10 data-leak attempts and 0 prompt-injection attempts.
Community Defense
Of the roughly 453 attacking IPs, 420 have been reported to AbuseIPDB. Reports are shared to help other operators block the same infrastructure.
This analysis was produced by a Raspberry Pi 5 honeypot located in Spain, running entirely open-source tooling. Data is collected passively and is shared to support the defensive community.
This analysis was generated by claude-haiku-5-5 via the Anthropic API for the Raspberry Pi 5 honeypot lab. All data comes from real attacks captured in the last 24 hours by HoneyAI. View the raw data report for complete metrics.