Honeypot Threat Analysis — October 25, 2026
Critical threat level — massive coordinated attack activity across all honeypot services.
Daily Threat Analysis: 2026-10-25
Threat Overview
Today’s honeypot telemetry from our Raspberry Pi 5 sensor in Spain recorded activity from approximately 578 unique attacker IPs across SSH, multi-protocol, HTTP, and IDS sources. Severity is rated critical, driven mainly by SSH post-authentication behavior and a high volume of Suricata alerts. Of these sources, 511 IPs have already been reported to AbuseIPDB.
Geographic Analysis
GeoIP enrichment covered 7,720 IPs. The United States accounted for the largest share at 28% (2,202), followed by China at 9% (746), Belgium at 6% (485), Germany at 5% (459), and the United Kingdom at 4% (384). Pakistan (338), the Netherlands (284), India (250), the Republic of Korea (222), and Hong Kong (220) rounded out the top ten. Geographic origin is a weak signal on its own, since many hosts in these countries are relays or compromised infrastructure.
SSH Brute Force
SSH was the dominant service. The honeypot logged 907 connections from 385 IPs, with 703 successful logins and 201 sessions that executed commands. The most frequently observed password values were 91566946b1d8deb0, aad3f9ba1d6740cc, 8d969eef6ecad3c2, 8294547e9fe9367f, and 5e884898da280471. These appear to be hash-like strings, which suggests automated credential lists rather than hand-picked guesses. The top-observed source IPs were 119.41.33.161, 1.163.221.31, 202.47.54.98, 72.255.18.52, and 202.47.50.10.
Post-Exploitation
Forty-one TTY sessions captured attacker command patterns. The most common command, run 796 times, was uname -s -v -n -r -m, a standard fingerprinting step. A second routine appeared 20 times in the form /bin/./uname -s -v -n -r -m, likely from a different toolkit.
The more concerning pattern appeared 44 times each in two variants. The first ran chattr -ia .ssh and lockr -ia .ssh, which attempts to clear immutable attributes on the SSH directory. The second removed the existing .ssh directory, recreated it, and wrote an attacker-controlled ssh-rsa public key into it. This is a clear persistence technique: it grants future key-based access that survives password changes. Two sessions also checked /proc/cpuinfo to assess CPU resources, a common step to distinguish sandboxes from real hardware or to size cryptomining payloads.
Web Scanning
HTTP traffic was light: 158 requests from 43 IPs. Requested paths were /, /SDK/webLanguage, /login, /test, and /api/status. The /SDK/webLanguage path is a known probe target for embedded camera and video device firmware, so this traffic likely reflects automated IoT-focused scanning.
IDS & Scan Intel
Suricata generated 93,122 alerts from 694 IPs. The alert volume far exceeds the number of unique hosts, indicating repeated signature hits from the same scanners. Multi-protocol activity (FTP, Telnet, SMTP, MySQL, Redis, Git, VNC, RDP) produced 9,324 events from 150 IPs. MSSQL recorded 6,855 events from 2 IPs, and SNMP recorded 27 events from 19 IPs. Backfire recorded zero scans and zero open targets.
Tarpit
The tarpit held 52 connections from 34 IPs. No time was wasted by the trapped clients in this period.
Canarytokens
Canarytokens triggered 88 times. One AWS token was activated by 168.222.244.156, with a Boto3/Botocore user agent on Linux running Python 3.12. This indicates an automated script attempting to use credentials it found, a sign that the bait was attractive enough to be tested.
MCP Trap
The MCP trap received 9 requests from 4 IPs. No tool invocations were recorded.
AI Defense
The AI defense layer blocked 10 data leak attempts and no prompt injection attempts.
Community Defense
Of today’s attacker population, 511 IPs have been reported to AbuseIPDB. Reporting these IPs helps other operators block repeat abuse. Blocklists built from honeypot data are most useful when they include the post-exploitation indicators, such as the .ssh key injection pattern, because those behaviors separate scanners from active intrusions.
This report was generated from a Raspberry Pi 5 honeypot operated from Spain using open-source tools. Data is collected passively and reflects only traffic directed at our sensor.
This analysis was generated by claude-haiku-5-5 via the Anthropic API for the Raspberry Pi 5 honeypot lab. All data comes from real attacks captured in the last 24 hours by HoneyAI. View the raw data report for complete metrics.