Saturday, 3 October 2026 💀 critical

Daily Threat Report

251 SSH Connections

87 Login Attempts

150 Commands Run

43 SSH Unique IPs

3,148 Protocol Events

108 Protocol IPs

51 Web Hits

26 Web Service IPs

Top Attacker IPs

Top Passwords Tried

1af4cfa0ae8cb48c
123321
1234
123456
1234567

🌐 WEB HONEYPOT — HoneyAI HTTP

AI-generated fake HTTP responses served to 51 scanner requests from 26 unique IPs (local, offline).

Top Paths Probed

/
/login
/hachk.php
/SDK/webLanguage
/mcp

Top User-Agents

Go-http-client/1.1
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
proxy-prefilter/1
Mozilla/5.0
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46

# Automatic multi-platform threat intel reporting
$ honeypot-report.sh --since 24h
→ 161 IPs → AbuseIPDB  (community confidence scores updated)
→ 161 IPs → AlienVault OTX  (pulse indicators added)
→ 161 IPs → Blocklist.de  (auto-ban list updated)
→ 161 IPs → DShield/SANS  (global threat feed updated)

🍯 HONEYPOT FILES ACCESSED

Bait files attackers tried to read after SSH login. All data is fake — but their intent is very real.

📄

cd $_dqCurrent Working Directory: /root

Fake honeypot file

📄

Fake honeypot file

📄

Files in current directory:

Fake honeypot file

🔑

.bash_history, .env, .github-token, company_passwords.docx, config.json, network_architecture.pdf, passwords.txt

Production password list (all fake)

📄

Fake honeypot file

📄

Non-interactive exec command executed successfully.$_dq && if [ ! -f $_dqw.sh$_dq ]; then cat > $_dqw.sh$_dq && chmod +x w.sh; fi

Fake honeypot file

📄

CRON=$_dq$(crontab -l 2>/dev/null || true)$_dq

Fake honeypot file

📄

echo $_dq$CRON$_dq | grep -F 'Current Working Directory: /root

Fake honeypot file

📄

Fake honeypot file

📄

Files in current directory:

Fake honeypot file

🔑

.bash_history, .env, .github-token, company_passwords.docx, config.json, network_architecture.pdf, passwords.txt

Production password list (all fake)

📄

Fake honeypot file

📄

Non-interactive exec command executed successfully./w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq' >/dev/null 2>&1 || \

Fake honeypot file

📄

printf '%s\n%s\n' $_dq@reboot Current Working Directory: /root

Fake honeypot file

📄

Fake honeypot file

📄

Files in current directory:

Fake honeypot file

🔑

.bash_history, .env, .github-token, company_passwords.docx, config.json, network_architecture.pdf, passwords.txt

Production password list (all fake)

📄

Fake honeypot file

📄

Non-interactive exec command executed successfully./w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq$_dq $_dq0 * * * * cd $_dqCurrent Working Directory: /root

Fake honeypot file

📄

Fake honeypot file

📄

Files in current directory:

Fake honeypot file

🔑

.bash_history, .env, .github-token, company_passwords.docx, config.json, network_architecture.pdf, passwords.txt

Production password list (all fake)

📄

Fake honeypot file

📄

Non-interactive exec command executed successfully.$_dq && ./w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq$_dq | (cat -; echo $_dq$CRON$_dq) | crontab -

Fake honeypot file

🎣 AWS credentials include a Canarytoken — if anyone uses these keys, we receive an alert with their real IP.

🤣 ATTACKER COMEDY CORNER

Real attempts. No actors were harmed in the making of this honeypot.

🔑 Hall of Shame — Passwords

Admin@123456

admin@2018

P@ssword123

U_tywg_2008

admin_123

💻 Commands They Tried

CRON=$_dq$(crontab -l 2>/dev/null || true)$_dq

echo $_dq$CRON$_dq | grep -F 'Current Working Directory: /root

Files in current directory:

.bash_history, .env, .github-token, company_passwords.docx, config.json, network_architecture.pdf, passwords.txt

Non-interactive exec command executed successfully./w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq' >/dev/null 2>&1 || \

printf '%s\n%s\n' $_dq@reboot Current Working Directory: /root

Files in current directory:

.bash_history, .env, .github-token, company_passwords.docx, config.json, network_architecture.pdf, passwords.txt

Non-interactive exec command executed successfully./w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq$_dq $_dq0 * * * * cd $_dqCurrent Working Directory: /root

Files in current directory:

.bash_history, .env, .github-token, company_passwords.docx, config.json, network_architecture.pdf, passwords.txt

Non-interactive exec command executed successfully.$_dq && ./w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq$_dq | (cat -; echo $_dq$CRON$_dq) | crontab -

CRON=$_dq$(crontab -l 2>/dev/null || true)$_dq

echo $_dq$CRON$_dq | grep -F 'Command received: `cd $(for d in /dev/shm /tmp /var/run /mnt /root / ; do [ -x $_dq$d$_dq ] && { cd $_dq$d$_dq; pwd; } && break; done) 2>/dev/null`

Detected potential attack attempt. The server will not respond to/w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq' >/dev/null 2>&1 || \

  printf '%s\n%s\n' $_dq@reboot  Command received: `cd $(for d in /dev/shm /tmp /var/run /mnt /root / ; do [ -x $_dq$d$_dq ] && { cd $_dq$d$_dq; pwd; } && break; done) 2>/dev/null`

Detected potential attack attempt. The server will not respond to/w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq$_dq $_dq0 * * * * cd $_dqCommand received: `cd $(for d in /dev/shm /tmp /var/run /mnt /root / ; do [ -x $_dq$d$_dq ] && { cd $_dq$d$_dq; pwd; } && break; done) 2>/dev/null`

Detected potential attack attempt. The server will not respond to$_dq && ./w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq$_dq | (cat -; echo $_dq$CRON$_dq) | crontab -

CRON=$_dq$(crontab -l 2>/dev/null || true)$_dq

echo $_dq$CRON$_dq | grep -F 'Running the specified command as root...

for d in /dev/shm /tmp /var/run /mnt /root /; do cd $_dq$d$_dq 2>/dev/null && pwd && break; done/w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq' >/dev/null 2>&1 || \

printf '%s\n%s\n' $_dq@reboot Running the specified command as root...

for d in /dev/shm /tmp /var/run /mnt /root /; do cd $_dq$d$_dq 2>/dev/null && pwd && break; done/w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq$_dq $_dq0 * * * * cd $_dqRunning the specified command as root...

for d in /dev/shm /tmp /var/run /mnt /root /; do cd $_dq$d$_dq 2>/dev/null && pwd && break; done$_dq && ./w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq$_dq | (cat -; echo $_dq$CRON$_dq) | crontab -

CRON=$_dq$(crontab -l 2>/dev/null || true)$_dq

echo $_dq$CRON$_dq | grep -F 'Command executed as root: sh -c 'for d in /dev/shm /tmp /var/run /mnt /root /; do cd $_dq$d$_dq 2>/dev/null && pwd && break; done'/w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq' >/dev/null 2>&1 || \

  printf '%s\n%s\n' $_dq@reboot  Command executed as root: sh -c 'for d in /dev/shm /tmp /var/run /mnt /root /; do cd $_dq$d$_dq 2>/dev/null && pwd && break; done'/w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq$_dq $_dq0 * * * * cd $_dqCommand executed as root: sh -c 'for d in /dev/shm /tmp /var/run /mnt /root /; do cd $_dq$d$_dq 2>/dev/null && pwd && break; done'$_dq && ./w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq$_dq | (cat -; echo $_dq$CRON$_dq) | crontab -

CRON=$_dq$(crontab -l 2>/dev/null || true)$_dq

echo $_dq$CRON$_dq | grep -F 'sh -c 'for d in /dev/shm /tmp /var/run /mnt /root /; do cd $_dq$d$_dq 2>/dev/null && pwd && break; done'/w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq' >/dev/null 2>&1 || \

  printf '%s\n%s\n' $_dq@reboot  sh -c 'for d in /dev/shm /tmp /var/run /mnt /root /; do cd $_dq$d$_dq 2>/dev/null && pwd && break; done'/w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq$_dq $_dq0 * * * * cd $_dqsh -c 'for d in /dev/shm /tmp /var/run /mnt /root /; do cd $_dq$d$_dq 2>/dev/null && pwd && break; done'$_dq && ./w.sh $_dqastats$_dq $_dqnetai$_dq $_dqkstats$_dq $_dqssh 2 az$_dq$_dq | (cat -; echo $_dq$CRON$_dq) | crontab -

These are real credentials and commands attempted by automated scanners and script kiddies. Logged, reported, and immortalized.

Automated report for 3 de octubre de 2026. Recorded 251 SSH connections and 3148 multi-protocol decoy events on HoneyAI, from 151 unique IPs. 161 IPs were automatically reported to the AbuseIPDB community database.

SSH Activity (HoneyAI)

The SSH service received 87 login attempts from 43 unique IPs. Attackers executed 150 commands after gaining simulated system access.

Multi-Protocol Decoys (HoneyAI)

Detected 3148 events across services including FTP, Telnet, SMTP, MySQL, Redis, Git, VNC, and RDP from 108 distinct IPs. All events are access attempts against simulated production services.

HTTP Web Service (HoneyAI)

The web service received 51 HTTP requests from real scanners across 26 unique IPs. Each attacker received a fake response generated in real time by the local AI engine (Ollama, no internet connection required).

MCP Agent Trap

The MCP decoy server received 12 requests from 6 unique IPs. Attackers attempted to call internal tools including credential extraction and system command execution.

MSSQL / SNMP Honeypots

The MSSQL decoy received 1344 authentication events from 1 IPs. The SNMP trap received 23 queries from 15 IPs probing community strings and OIDs.

Portscan Detection

Detected 0 incoming port scan events from 0 unique IPs.

AI Defense Stats

Blocked 0 prompt injection attempts and 15 identity leak attempts.

Active Defense (Operation Spine)

HoneyAI performed 0 reverse port scans back to active attacker IPs. Out of these, 0 hosts were found running open public services, allowing backfire profiling.

Network IDS (Suricata)

The network intrusion detection system generated 5391 alerts from 522 unique source IPs. Suricata monitors all traffic on the primary network interface using Emerging Threats + AlienVault OTX rulesets.

← All Reports 🛡️ Subscribe to blocklists →