Honeypot Threat Analysis — October 23, 2026
Critical threat level — massive coordinated attack activity across all honeypot services.
Threat Overview
On 2026-10-23, the honey-ai.dev sensor, a Raspberry Pi 5 in Spain, logged activity from approximately 426 attackers, rated critical. Suricata generated 90,805 alerts from 681 IPs, and 376 of the observed sources have been reported to AbuseIPDB.
Geographic Analysis
Of 7,132 geolocated IPs, the United States accounted for 29% (2,090), followed by China at 8% (641), Belgium at 6% (455), Germany at 6% (449), and the United Kingdom at 5% (364). Pakistan (4%, 326), the Netherlands (3%, 263), India (2%, 208), Hong Kong (2%, 207), and the Republic of Korea (2%, 196) completed the top ten. The GeoIP total covers a much broader IP set than the attacker count, so it should be read as a separate measurement.
SSH Brute Force
SSH was the most active vector: 608 connections, 475 login attempts, and 133 executed commands from 254 IPs. The most frequent logged passwords were 16-character hex strings (aad3f9ba1d6740cc, 91566946b1d8deb0, 8d969eef6ecad3c2, a665a45920422f9d, 6b86b273ff34fce1). Their uniform format suggests credentials are stored hashed or truncated, which should be verified against logger configuration. The top source IPs were 171.91.118.234, 120.193.224.186, 153.117.33.156, 137.59.230.58, and 124.29.214.10.
Post-Exploitation
Forty-one TTY sessions captured commands. The most common was uname -s -v -n -r -m, run 796 times, plus 20 executions via /bin/./uname, a host fingerprinting step. Smaller sessions checked CPU details via /proc/cpuinfo.
The more significant pattern was SSH key persistence. In 44 sessions, the attacker ran chattr -ia .ssh and lockr -ia .ssh to clear immutable attributes, then ran rm -rf .ssh, recreated the directory, and wrote an ssh-rsa public key to it. This replaces legitimate access with attacker-controlled access. Key material is truncated in the log and is not reproduced here.
Web Scanning
HTTP activity totaled 108 requests from 50 IPs. Requested paths included /, /SDK/webLanguage, /favicon.ico, /hachk.php, and /boaform/admin/formLogin with a credential-style query string. The last two target embedded-device web interfaces, which are common targets for automated exploitation.
IDS & Scan Intel
Multi-protocol probing produced 5,393 events from 122 IPs across FTP, Telnet, SMTP, MySQL, Redis, Git, VNC, and RDP. MSSQL recorded 3,135 events from a single IP, and SNMP recorded 35 events from 13 IPs.
Tarpit
The tarpit trapped 71 connections from 45 IPs. It recorded 0 hours of attacker time wasted, a figure worth reviewing against the trapped connection count.
Canarytokens
Canarytokens fired 99 times. An AWS token was triggered from 168.222.244.156 with a Boto3/1.43.114 user agent on Linux x86_64 running Python 3.12.15. This indicates automated tooling interacting with a planted AWS credential.
MCP Trap
The MCP trap received 12 requests from 5 IPs. No tools were invoked.
AI Defense
The AI defense layer blocked 0 injection attempts and 8 data leak attempts.
Community Defense
Of the observed attackers, 376 have been reported to AbuseIPDB. Reporting confirmed malicious IPs helps the wider community block repeat activity.
honey-ai.dev runs on a Raspberry Pi 5 in Spain, using open-source tooling for all collection and analysis. Findings are shared openly so defenders can use them.
This analysis was generated by claude-haiku-5-5 via the Anthropic API for the Raspberry Pi 5 honeypot lab. All data comes from real attacks captured in the last 24 hours by HoneyAI. View the raw data report for complete metrics.