Honeypot Threat Analysis — October 24, 2026
Critical threat level — massive coordinated attack activity across all honeypot services.
Threat Overview
On 2026-10-24, the honey-ai.dev sensor network recorded activity from approximately 491 unique attackers, and the day’s overall severity is rated critical. SSH was the dominant vector, with 984 connections and 785 login attempts. Suricata IDS logged 91,828 alerts from 850 source IPs, and multi-protocol services (FTP, Telnet, SMTP, MySQL, Redis, Git, VNC, RDP) logged 7,333 events from 118 IPs.
Geographic Analysis
GeoIP attribution across 7,399 observed IPs placed the largest share in the United States (2,144, 28%), followed by China (689, 9%), Belgium (469, 6%), Germany (454, 6%), and the United Kingdom (368, 4%). Pakistan (327, 4%), the Netherlands (272, 3%), India (228, 3%), Hong Kong (214, 2%), and the Republic of Korea (209, 2%) completed the top ten. Geographic distribution in scanning traffic often reflects hosted infrastructure and proxies rather than the true origin of operators, so these figures should be read as indicators, not attribution.
SSH Brute Force
SSH activity was concentrated among a small set of hosts. The most active source IPs were 221.200.73.245, 183.203.205.5, 14.120.48.247, 62.60.134.212, and 62.60.134.210. The most frequently attempted passwords were 91566946b1d8deb0, aad3f9ba1d6740cc, 8c6976e5b5410415, e0bc60c82713f64e, and 1234. The recurrence of hash-like strings suggests automated credential lists rather than manual guessing.
Post-Exploitation
Forty-one TTY sessions were captured, and the command patterns show a consistent playbook:
- Reconnaissance:
uname -s -v -n -r -mappeared 796 times, and a variant using/bin/./unameappeared 20 times. - CPU profiling: Two sessions ran
cat /proc/cpuinfo | grep name | wc -land a relatedhead -n 1check. - SSH persistence: 44 sessions executed
chattr -ia .sshandlockr -ia .ssh, removing immutability before modification. A further 44 sessions ranrm -rf .ssh, recreated the directory, and wrote an attacker-controlledssh-rsapublic key intoauthorized_keys.
The key-injection sequence is the most significant finding: it establishes persistent access that survives password changes.
Web Scanning
HTTP traffic totaled 179 requests from 41 IPs. The most requested paths were /, /hachk.php, /SDK/webLanguage, /.env, and /login. Requests for /.env and /hachk.php are typical of automated scanners searching for exposed configuration files and known vulnerable scripts.
IDS & Scan Intel
Suricata generated 91,828 alerts from 850 IPs, the highest alert volume of any category today. Alert counts at this scale typically reflect signature-heavy scanning and repeated probing rather than discrete intrusions.
Tarpit
The tarpit held 99 connections from 41 IPs. The sensor logged 0h of wasted attacker time, which indicates that the tarpit delay was not effective against these sessions.
Canarytokens
Canarytokens triggered 86 times. Notably, an AWS token was triggered from 168.222.244.156 with the user-agent Boto3/1.43.114 ... lang/python#3.12.15, indicating an automated Python-based client attempting to use credentials that were planted as bait.
MCP Trap
The MCP trap recorded 15 requests from 6 IPs. No tools were invoked.
AI Defense
The AI defense layer blocked 20 data-leak attempts and 0 prompt-injection attempts.
Community Defense
AbuseIPDB records show 451 of today’s attacker IPs have been reported, contributing to shared threat intelligence.
Analysis from a Raspberry Pi 5 honeypot in Spain, built on open-source tooling. Data reflects only this sensor’s observations and is shared to support community defense.
This analysis was generated by claude-haiku-5-5 via the Anthropic API for the Raspberry Pi 5 honeypot lab. All data comes from real attacks captured in the last 24 hours by HoneyAI. View the raw data report for complete metrics.