MONTHLY SUMMARY  //  SSH + TELNET + WEB  //  JULY 2026

July 2026 — Monthly Honeypot Summary

Traffic by day

July 25 carries 48% of the month's SSH volume on its own, and it is one host: 80.190.82.187 opened 27,509 sessions issuing nothing but echo -e "\x6F\x6B". Remove it and the eight days run between 3,100 and 6,400 sessions with no meaningful trend. Any monthly figure quoted without that exclusion is a statement about one scanner rather than about the internet.

Web sensor by day

What ran this month

mdrfckr — SSH key implant

2,169 executions across 204 source addresses, writing a byte-identical authorized_keys every single time (a8460f44…). The sequence never varied: clear immutable flags with chattr -ia, delete ~/.ssh, recreate it, write one attacker key. Volume doubled between the two reporting periods, from 708 to 1,461, with no change to the payload. One operator, one key, no per-target customisation.

Redtail — cryptominer, two delivery paths

The familiar multi-architecture upload set arrived by SCP — clean.sh, setup.sh, and binaries for arm7, arm8, i686, riscv and x86_64, 14 observations each. Shipping a RISC-V build to a host that has advertised nothing about its architecture is spraying, not targeting.

The same campaign also ran a second, quieter delivery path that produced no captures at all: 217.60.195.113 served a telnet loader over HTTPS with certificate validation explicitly disabled (wget --no-check-certificate -qO- falling back to curl -sk), piped into sh -s telnet. The command ends with a hex string decoding to redtail_bot_telnet_ok. Nothing was retrieved for analysis, which is the entire point of the TLS.

nerv — new, single-source, single-day

On July 31 alone, 171.244.44.251 opened 204 telnet sessions each running one line and nothing else, fetching nerv.x86_64 from the scanning host itself. Only an x86_64 build was ever offered. It is the only source in the month that is not datacenter infrastructure — Viettel, a Vietnamese fixed-line ISP — which makes it a compromised connection rather than rented capacity.

Fake sshd — uploaded, never run

A binary named sshd was uploaded 12 times from at least six sources across three distinct hashes, and never executed in any session. An independently published dataset from November 2025 identifies this artifact as a BillGates/Elknot DDoS bot; that attribution is not confirmed here, because nothing on this sensor ever ran it. Three builds are held for static analysis.

Infrastructure

The sprayers rent from two companies

The distributed brute force that dominates both periods looks like three unrelated netblocks — 91.92.4x, 45.156.87.x, 77.239.124.x — with per-host session counts that are suspiciously exact: eight hosts at precisely 773 sessions in the second period, five at 762 in the first. Reputation lookups resolve it. Thirteen of those addresses belong to a single Dutch provider, TechTies Inc.; the remainder to ROCKET & MARINICA at the same facility. Three ranges, two companies, one scheduler handing out equal quotas.

Nothing scanning this sensor is residential

Every busy source on the web sensor is commodity cloud: Microsoft Azure across Hong Kong, Switzerland and Brazil regions, plus Vultr, OVH and Majestic Hosting. All at 100% confidence with hundreds to thousands of reports each. This is scanning rented by the hour from providers whose abuse desks already know about these exact addresses.

Reputation scoring tracks volume, not danger

This is the month's most useful finding, and it only appears once the two populations are put side by side.

hosts that delivered malware

hosts that only made noise

The exception runs the other way and is worth noting: the nerv host scores 92% with 69 reports. It is also the only non-datacenter address in the set. Rented delivery infrastructure gets rotated before anyone reports it; a compromised consumer line sits there accumulating reports because nobody is paying to move it.

Aggregates

Most attempted credentials

Files uploaded to the sensor

Period reports

Full session detail, indicator tables, hashes with VirusTotal links, and per-period ATT&CK mappings are in the two reports this summary draws on:

Carried into August

• Three sshd builds held for static analysis — the only artifacts this month that were captured but not explained.
• Whether nerv reappears, and whether it stays single-architecture.
• Whether the TechTies quota pattern survives the month boundary, and whether the quota value itself changes.
• Recovering July 1–23 if the archives can be reconstructed, which would make the next monthly summary an actual month.