Monday, 12 October 2026 💀 critical

Daily Threat Report

513 SSH Connections
437 Login Attempts
76 Commands Run
29 SSH Unique IPs
6,682 Protocol Events
114 Protocol IPs
65 Web Hits
35 Web Service IPs

Top Attacker IPs

  1. 🌐 221.213.61.208 BGP↗
  2. 🌐 60.189.136.115 BGP↗
  3. 🌐 101.53.255.91 BGP↗
  4. 🌐 202.47.54.18 BGP↗
  5. 🌐 72.255.26.227 BGP↗

Top Passwords Tried

  1. 10022007
  2. cafe
  3. 4660
  4. simple1
  5. 12091959

🌐 WEB HONEYPOT — HoneyAI HTTP

AI-generated fake HTTP responses served to 65 scanner requests from 35 unique IPs (local, offline).

Top Paths Probed

  1. /
  2. /SDK/webLanguage
  3. /login
  4. /query?q=SHOW+DIAGNOSTICS
  5. /hachk.php

Top User-Agents

  1. Go-http-client/1.1
  2. Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46
  3. Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
  4. Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
  5. Mozilla/5.0 zgrab/0.x
# Automatic multi-platform threat intel reporting
$ honeypot-report.sh --since 24h
→ 153 IPs → AbuseIPDB  (community confidence scores updated)
→ 153 IPs → AlienVault OTX  (pulse indicators added)
→ 153 IPs → Blocklist.de  (auto-ban list updated)
→ 153 IPs → DShield/SANS  (global threat feed updated)

🤣 ATTACKER COMEDY CORNER

Real attempts. No actors were harmed in the making of this honeypot.

🔑 Hall of Shame — Passwords

4rdf_king7
0aa6feb421c953ed
q1w2e3r4t5y6u7
Admin@123
.adgjmptw

💻 Commands They Tried

export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C
uname=$(for c in uname /bin/uname /usr/bin/uname 'busybox uname' 'toybox uname'; do v=$($c -s -v -n -m 2>/dev/null) && [ -n $_dq$v$_dq ] && { printf '%s\n' $_dq$v$_dq; exit; }; done; IFS= read -r v < /proc/version && printf '%s\n' $_dq$v$_dq) 2>/dev/null
arch=$(for c in uname /bin/uname /usr/bin/uname 'busybox uname' 'toybox uname'; do v=$($c -m 2>/dev/null) && [ -n $_dq$v$_dq ] && { printf '%s\n' $_dq$v$_dq; exit; }; done; for c in arch 'busybox arch' 'toybox arch'; do v=$($c 2>/dev/null) && [ -n $_dq$v$_dq ] && { printf '%s\n' $_dq$v$_dq; exit; }; done; printf '%s\n' unknown)
uptime=$(IFS= read -r v < /proc/uptime && printf '%s\n' $_dq$v$_dq || cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null || toybox cat /proc/uptime 2>/dev/null) 2>/dev/null
cpus=$(unset OMP_NUM_THREADS OMP_THREAD_LIMIT; for c in nproc /usr/bin/nproc 'busybox nproc' 'toybox nproc'; do v=$($c 2>/dev/null) || continue; case $v in ''|*[!0-9]*) continue ;; esac; [ $_dq$v$_dq -gt 0 ] 2>/dev/null && { printf '%s\n' $_dq$v$_dq; exit; }; done; for a in awk 'busybox awk' 'toybox awk'; do $a 'BEGIN { exit 0 }' </dev/null 2>/dev/null && break; done; v=$($a 'function count(s, a,b,n,i,t,m) { gsub(/[[:space:]]/,$_dq$_dq,s); n=split(s,a,$_dq,$_dq); for(i=1;i<=n;i++) { if(a[i]!~/^[0-9]+(-[0-9]+)?$/) return 0; m=split(a[i],b,$_dq-$_dq); if(m==2 && b[2]+0<b[1]+0) return 0; t+=(m==2?b[2]-b[1]+1:1) } return t } BEGIN { while((getline s < $_dq/proc/self/status$_dq)>0) if(s~/^Cpus_allowed_list:/) { sub(/^[^:]*:/,$_dq$_dq,s); n=count(s); if(n>0) { print n; exit } } }' 2>/dev/null); [ -n $_dq$v$_dq ] && { printf '%s\n' $_dq$v$_dq; exit; }; for c in getconf 'busybox getconf' 'toybox getconf'; do v=$($c _NPROCESSORS_ONLN 2>/dev/null) || continue; case $v in ''|*[!0-9]*) continue ;; esac; [ $_dq$v$_dq -gt 0 ] 2>/dev/null && { printf '%s\n' $_dq$v$_dq; exit; }; done; v=$($a 'BEGIN { if((getline s < $_dq/sys/devices/system/cpu/online$_dq)>0 && s~/^[0-9]+(-[0-9]+)?(,[0-9]+(-[0-9]+)?)*$/) { k=split(s,a,$_dq,$_dq); for(i=1;i<=k;i++) { m=split(a[i],b,$_dq-$_dq); if(m==2 && b[2]+0<b[1]+0) { n=0; break } n+=(m==2?b[2]-b[1]+1:1) } if(n>0) { print n; exit } } while((getline s < $_dq/proc/cpuinfo$_dq)>0) { if(s~/^[[:space:]]*processor[[:space:]]*:[[:space:]]*[0-9]+[[:space:]]*$/ || s~/^[[:space:]]*processor[[:space:]]+[0-9]+:/) n++; if(s~/^[[:space:]]*#[[:space:]]*processors[[:space:]]*:/) { sub(/^[^:]*:/,$_dq$_dq,s); p=s+0 } } if(n>0) print n; else if(p>0) print p }' 2>/dev/null); printf '%s\n' $_dq${v:-unknown}$_dq)
cpu_model=$(for a in awk 'busybox awk' 'toybox awk'; do $a 'BEGIN { exit 0 }' </dev/null 2>/dev/null && break; done; r() { [ -r $_dq$1$_dq ] || return; while IFS= read -r s || [ -n $_dq$s$_dq ]; do printf '%s\n' $_dq$s$_dq; done < $_dq$1$_dq; }; v=$({ lscpu 2>/dev/null || busybox lscpu 2>/dev/null || toybox lscpu 2>/dev/null; printf '\n@@CPUINFO@@\n'; r /proc/cpuinfo; printf '\n@@MIDR@@\n'; for f in /sys/devices/system/cpu/cpu[0-9]*/regs/identification/midr_el1; do r $_dq$f$_dq; done; } | $a 'function trim(s) { gsub(/^[[:space:]]+|[[:space:]]+$/, $_dq$_dq, s); return s } function useful(s, t) { t=tolower(trim(s)); return t!=$_dq$_dq && t!~/^(unknown|undefined|unspecified|not specified|not available|not present|not installed|default string|to be filled by o\.e\.m\.|n\/a|none|null|\(null\)|-|(0x)?[0-9a-f]+)$/ && t!~/^(unknown|unidentified|unrecognized)([[:space:]]|$)/ && t!~/^(armv[0-9]+(-compatible)?|aarch64|arm64|arm)([[:space:]]+processor|[[:space:]]*\(|$)/ && t!~/^(armv[0-9]+|aarch64|arm64|arm|processor|cpu|riscv(32|64)?|risc-v|x86_64|amd64|i[3-6]86|ppc64(le)?|powerpc|loongarch64|s390x)$/; } function number(s, n,i,d) { s=tolower(trim(s)); n=0; if(s~/^0x[0-9a-f]+$/) { for(i=3;i<=length(s);i++) { d=index($_dq0123456789abcdef$_dq,substr(s,i,1))-1; n=n*16+d } return n; } return s~/^[0-9]+$/ ? s+0 : -1; } function addname(s) { if(useful(s) && !names[s]++) name[++nn]=s } function arm(impl,part, id,s) { impl=number(impl); part=number(part); if(impl<0 || impl>255 || part<0 || part>4095) return; id=sprintf($_dq%02x:%03x$_dq,impl,part); if(ids[id]++) return; s=parts[id]; if(s==$_dq$_dq) s=$_dqARM implementer=0x$_dq substr(id,1,2) $_dq part=0x$_dq substr(id,4); core[++nc]=s; } functi
export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH
uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '$_dq' ) || echo $_dq$_dq)
arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q $_dqlm$_dq /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q $_dqCPU architecture: 8$_dq /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q $_dqCPU architecture: 7$_dq /proc/cpuinfo && echo armv7l ) || echo $_dq$_dq)
uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)
cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c $_dq^processor$_dq /proc/cpuinfo 2>/dev/null)
cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E $_dq^model name$_dq /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E $_dq^Hardware$_dq /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )
gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )
last_output=$(last 2>/dev/null)
filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf $_dq#!/bin/bash\necho \$_dqxxxxxx\$_dq\n$_dq > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case $_dq$out$_dq in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf $_dq#!/bin/bash\necho \$_dqxxxxxx\$_dq\n$_dq > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case $_dq$out$_dq in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf $_dq#!/bin/bash\necho \$_dqxxxxxx\$_dq\n$_dq > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case $_dq$out$_dq in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf $_dq#!/bin/sh\necho \$_dqxxxxxx\$_dq\n$_dq > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf $_dq#!/bin/sh\necho \$_dqxxxxxx\$_dq\n$_dq > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' $_dq$out$_dq | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 )
echo $_dqUNAME:$uname$_dq
echo $_dqARCH:$arch$_dq
echo $_dqUPTIME:$uptime$_dq
echo $_dqCPUS:$cpus$_dq
echo $_dqCPU_MODEL:$cpu_model$_dq
echo $_dqGPU:$gpu_info$_dq
echo $_dqLAST:$last_output$_dq
echo $_dqFILTER:$filter_output$_dq

These are real credentials and commands attempted by automated scanners and script kiddies. Logged, reported, and immortalized.

Automated report for 12 de octubre de 2026. Recorded 513 SSH connections and 6682 multi-protocol decoy events on HoneyAI, from 143 unique IPs. 153 IPs were automatically reported to the AbuseIPDB community database.

SSH Activity (HoneyAI)

The SSH service received 437 login attempts from 29 unique IPs. Attackers executed 76 commands after gaining simulated system access.

Multi-Protocol Decoys (HoneyAI)

Detected 6682 events across services including FTP, Telnet, SMTP, MySQL, Redis, Git, VNC, and RDP from 114 distinct IPs. All events are access attempts against simulated production services.

HTTP Web Service (HoneyAI)

The web service received 65 HTTP requests from real scanners across 35 unique IPs. Each attacker received a fake response generated in real time by the local AI engine (Ollama, no internet connection required).

MCP Agent Trap

The MCP decoy server received 8 requests from 4 unique IPs. Attackers attempted to call internal tools including credential extraction and system command execution.

MSSQL / SNMP Honeypots

The MSSQL decoy received 4938 authentication events from 3 IPs. The SNMP trap received 26 queries from 17 IPs probing community strings and OIDs.

Portscan Detection

Detected 0 incoming port scan events from 0 unique IPs.

AI Defense Stats

Blocked 0 prompt injection attempts and 9 identity leak attempts.

Active Defense (Operation Spine)

HoneyAI performed 0 reverse port scans back to active attacker IPs. Out of these, 0 hosts were found running open public services, allowing backfire profiling.

Network IDS (Suricata)

The network intrusion detection system generated 20473 alerts from 585 unique source IPs. Suricata monitors all traffic on the primary network interface using Emerging Threats + AlienVault OTX rulesets.

← All Reports 🛡️ Subscribe to blocklists →