Honeypot Threat Analysis — October 26, 2026
Critical threat level — massive coordinated attack activity across all honeypot services.
Threat Intelligence Report: 2026-10-26
Threat Overview
Today’s honeypot activity was classified as critical severity. Across all sensors, about 505 unique attackers were observed. Multi-protocol services (FTP, Telnet, SMTP, MySQL, Redis, Git, VNC, RDP) recorded 5,677 events from 139 IPs. Suricata IDS generated 91,199 alerts from 819 IPs, and MSSQL drew 3,126 hits from a single IP. SNMP saw 66 requests from 27 IPs.
Geographic Analysis
GeoIP enrichment covered 8,007 IPs. The United States led with 2,266 (28%), followed by China with 780 (9%) and Belgium with 500 (6%). Germany (465, 5%) and the United Kingdom (414, 5%) were next, then Pakistan (346, 4%), the Netherlands (293, 3%), India (258, 3%), Hong Kong (239, 2%), and the Republic of Korea (231, 2%). Many of these sources are likely relays or cloud-hosted infrastructure, so country counts should be read as indicators of origin rather than attacker location.
SSH Brute Force
SSH was the most active service. It logged 1,320 connections from 320 IPs, of which 664 login attempts succeeded and 656 commands were executed. The most frequent source IPs were 60.29.66.38, 179.43.153.2, 103.171.168.74, 153.117.37.229, and 175.107.1.93. The most common passwords were aad3f9ba1d6740cc, 91566946b1d8deb0, 436e286ff069c278, 9f86d081884c7d65, and ab0c16f2769c75b4. These values appear as hash-like strings, which suggests attackers are reusing credential lists from prior campaigns.
Post-Exploitation
Forty-one TTY sessions were recorded. The dominant command was uname -s -v -n -r -m, seen 796 times, which is standard fingerprinting. A second pattern appeared 44 times: chattr -ia .ssh followed by lockr -ia .ssh. This removes immutable attributes so the directory can be modified. The same sessions also ran rm -rf .ssh, recreated the directory, and wrote an RSA public key into it. This is a persistence technique that plants an attacker-controlled key for future logins. A variant of the uname command using /bin/./ appeared 20 times, and two sessions checked /proc/cpuinfo, likely to determine CPU resources before deploying payloads.
Web Scanning
HTTP recorded 108 requests from 46 IPs. Requested paths were /, /SDK/webLanguage, /login, /favicon.ico, and /hachk.php. The /SDK/webLanguage path is a known probe for embedded device interfaces, and /hachk.php is a common target for scanners looking for exposed router or CMS files.
IDS & Scan Intel
Suricata’s 91,199 alerts from 819 IPs were the largest signal by volume, and the alert count far exceeds the number of unique attackers, indicating repeated rule matches per source. No portscan activity was recorded.
Tarpit
The tarpit held 164 connections from 86 IPs. Trapped time was not measured in this period.
Canarytokens
Canarytokens triggered 95 times. One AWS token was activated from 168.222.244.156. The user agent was Boto3/1.43.114 on Linux 7.0.0 x86_64 with Python 3.12.15. This suggests scripted use of AWS credentials, which should be treated as a possible credential-harvesting attempt.
MCP Trap
The MCP trap received 15 requests from 6 IPs. No tool invocations were recorded.
AI Defense
No prompt injection attempts were blocked. Sixteen data-leak attempts were blocked.
Community Defense
AbuseIPDB received 472 reports from today’s data, contributing to shared blocklists.
Run on a Raspberry Pi 5 in Spain using open-source honeypot and monitoring tools. Data is published for community defense.
This analysis was generated by claude-haiku-5-5 via the Anthropic API for the Raspberry Pi 5 honeypot lab. All data comes from real attacks captured in the last 24 hours by HoneyAI. View the raw data report for complete metrics.