Daily Threat Report
590 SSH Connections
275 Login Attempts
460 Commands Run
49 SSH Unique IPs
11,840 Protocol Events
92 Protocol IPs
85 Web Hits
19 Web Service IPs
8 Reverse Scans
8 Scan Hits
Top Attacker IPs
Top Passwords Tried
- password123
- admin123
- root
- 123456
- ftpuser
🌐 WEB HONEYPOT — HoneyAI HTTP
AI-generated fake HTTP responses served to 85 scanner requests from 19 unique IPs (local, offline).
Top Paths Probed
- /
- /login
- /wp-admin
- /dispatch.asp
- /.env
- /solr/admin/info/system
Top User-Agents
- Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
- Go-http-client/1.1
- curl/7.88.1
- Mozilla/5.0 (X11; Linux x86_64)
💥 OPERATION SPINE — Reverse Port Scanning
Active defense back-profiling: HoneyAI executed **8** reverse port-scans against active attacker IPs. Out of these, **8** hosts were found with open services.
# Automatic multi-platform threat intel reporting $ honeypot-report.sh --since 24h → 108 IPs → AbuseIPDB (community confidence scores updated) → 108 IPs → AlienVault OTX (pulse indicators added) → 108 IPs → Blocklist.de (auto-ban list updated) → 108 IPs → DShield/SANS (global threat feed updated)
🤣 ATTACKER COMEDY CORNER
Real attempts. No actors were harmed in the making of this honeypot.
🔑 Hall of Shame — Passwords
password123 hunter2 letmein123 💻 Commands They Tried
export PATH=$PATH:/tmp cat /etc/shadow 2>/dev/null rm -rf /root/.bash_history These are real credentials and commands attempted by automated scanners and script kiddies. Logged, reported, and immortalized.
Daily Threat Intelligence Report — 2026-08-13
Executive Overview
On August 13, 2026, the Honey-AI.Dev sensor grid logged 11840 threat events from 122 unique attacking IP addresses. Attack vectors spanned SSH, Telnet, HTTP, MySQL, MSSQL, and RDP.
Key Metrics Summary
- Total Alert Events: 11840
- Unique Attacker IPs: 122
- SSH Connections: 590 (275 auth attempts, 460 commands executed)
- Web Exploitation Requests (Galah): 85 across 19 unique endpoints
- Threat Intel Reports Dispatched: 108 IPs reported to AbuseIPDB, Blocklist.de, DShield, and OTX.