HONEYPOT REPORT  //  SSH + TELNET + WEB  //  2026-07-28 – 2026-07-31  //  CLOSES JULY

2026-07-28 – 2026-07-31 — SSH, Telnet + Web Honeypot Report

SSH and telnet connection volume by day

Log filenames lag their contents by one day (UTC rollover); all figures here are keyed on record timestamps, not filenames.

Executive summary

With the July 25 outlier gone, this period is the more honest picture — and it inverts. Failed logins (11,727) now outnumber successes (5,353) better than two to one, the reverse of the previous period. Unique sources rose 38% to 1,197 while total sessions fell by half. More actors, each doing less: the signature of distributed brute force rather than a few loud hosts.

The clearest evidence is in the per-source counts. Eight separate addresses across 91.92.42.0/24, 45.156.87.0/24 and 77.239.124.0/24 each opened exactly 773 sessions. Identical counts across what look like unrelated netblocks is not coincidence; it is a scheduler dividing a target list into equal shares and handing each worker a quota. Reputation lookups then close the loop: every one of the 91.92.4x, 45.156.87.x and 45.153.34.x hosts is registered to a single Dutch provider, TechTies Inc., and the 77.239.124.x hosts to ROCKET & MARINICA at the same Dutch facility. Three netblocks, two companies, one operation. The same pattern appeared in the prior period at 762 sessions per host.

The most interesting single session came from 91.92.40.18, and it is a step above the commodity traffic. Before deploying anything it walks /proc/[0-9]*/maps looking for processes with no linked libraries — a check for other implants, or for the kind of statically-linked binary its own family drops. It then attempts payload retrieval through a fallback chain: wget -O, then wget -O- piped to shell, and finally a hex-encoded script that opens /dev/tcp/91.199.133.133/8080 directly and hand-writes an HTTP request. That last method needs neither wget nor curl to exist on the target.

The script also contains explanatory comments — # Method 1: wget with -O flag (most common) — which survived into the deployed version. Someone wrote this to be read by other people.

The mdrfckr key implant doubled to 1,461 executions, still writing the same a8460f44… file. A binary named sshd also appeared in the upload set for the first time, alongside the usual Redtail architecture spread.

On the web sensor, requests rose to 9,479 with a shift in character: systematic WordPress admin enumeration, with /wp-admin/index.php, profile.php, edit.php and plugins.php each hit exactly 84 times. The same even-quota fingerprint as the SSH traffic.

Notable sessions — SSH and telnet

Notable sessions — web

Indicators

Payload hosts and URLs

Reputation figures are AbuseIPDB confidence scores with total report counts in parentheses. Read them against the source addresses further down.

Payload hashes

Each hash links to VirusTotal rather than carrying a transcribed detection count, which would be stale within a month.

Other captured artifacts

These were captured by the sensor and hashed alongside the payloads, but neither is a malware sample. Both are still usable indicators — the authorized_keys file is byte-identical across every mdrfckr instance, which makes it a reliable campaign signature. Expect low or zero detections on VirusTotal; that is the correct result for a text file and a newline, not a sign the lookup failed.

Source addresses

Busiest sources on both sensors. Confidence tracks how often an address has been reported elsewhere, which is a measure of volume rather than of danger — compare these scores with the payload hosts above.

Attacker behaviour

Credentials attempted

Client fingerprints

Web paths requested

Raw log excerpts

slattery@sec:~/archive$ jq -r 'select(.eventid=="cowrie.session.connect") | .src_ip' cowrie.2026-07-2[7-9].json cowrie.2026-07-30.json | sort | uniq -c | sort -rn | head -8

   1043 45.156.87.254
    773 91.92.42.81
    773 91.92.42.7
    773 91.92.42.36
    773 45.156.87.93
    773 77.239.124.250
    773 91.92.42.172
    773 45.156.87.216

slattery@sec:~/archive$ jq -r 'select(.eventid=="cowrie.session.file_download") | .url' cowrie.2026-07-2*.json | sort | uniq -c | sort -rn

    204 hxxp://171.244.44.251:80/nerv.x86_64   (command only, not captured)
     40 hxxp://91.199.133.133:8080/deploy.sh
     12 hxxp://94.154.43.88/ohshit.sh
      2 hxxp://51.75.118.165:20130/loader.sh
      2 hxxp://51.75.118.165:20130/dl/BlahajNet.x86_64
      1 hxxp://5.182.210.61/ok
      1 hxxp://187.77.145.183:8081/payload.sh

MITRE ATT&CK mapping