Daily Threat Report
820 SSH Connections
430 Login Attempts
690 Commands Run
74 SSH Unique IPs
19,800 Protocol Events
148 Protocol IPs
175 Web Hits
36 Web Service IPs
8 Reverse Scans
8 Scan Hits
Top Attacker IPs
Top Passwords Tried
- root
- admin
- 123456
- administrator
- service
🌐 WEB HONEYPOT — HoneyAI HTTP
AI-generated fake HTTP responses served to 175 scanner requests from 36 unique IPs (local, offline).
Top Paths Probed
- /
- /login
- /wp-admin
- /dispatch.asp
- /.env
- /solr/admin/info/system
Top User-Agents
- Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
- Go-http-client/1.1
- curl/7.88.1
- Mozilla/5.0 (X11; Linux x86_64)
💥 OPERATION SPINE — Reverse Port Scanning
Active defense back-profiling: HoneyAI executed **8** reverse port-scans against active attacker IPs. Out of these, **8** hosts were found with open services.
# Automatic multi-platform threat intel reporting $ honeypot-report.sh --since 24h → 162 IPs → AbuseIPDB (community confidence scores updated) → 162 IPs → AlienVault OTX (pulse indicators added) → 162 IPs → Blocklist.de (auto-ban list updated) → 162 IPs → DShield/SANS (global threat feed updated)
🤣 ATTACKER COMEDY CORNER
Real attempts. No actors were harmed in the making of this honeypot.
🔑 Hall of Shame — Passwords
root hunter2 letmein123 💻 Commands They Tried
export PATH=$PATH:/tmp cat /etc/shadow 2>/dev/null rm -rf /root/.bash_history These are real credentials and commands attempted by automated scanners and script kiddies. Logged, reported, and immortalized.
Daily Threat Intelligence Report — 2026-08-14
Executive Overview
On August 14, 2026, the Honey-AI.Dev sensor grid logged 19800 threat events from 178 unique attacking IP addresses. Attack vectors spanned SSH, Telnet, HTTP, MySQL, MSSQL, and RDP.
Key Metrics Summary
- Total Alert Events: 19800
- Unique Attacker IPs: 178
- SSH Connections: 820 (430 auth attempts, 690 commands executed)
- Web Exploitation Requests (Galah): 175 across 36 unique endpoints
- Threat Intel Reports Dispatched: 162 IPs reported to AbuseIPDB, Blocklist.de, DShield, and OTX.