HONEYPOT REPORT  //  2026-08-16 – 2026-08-20

2026-08-16 – 2026-08-20 — SSH, Telnet + Web Honeypot Report

SSH and telnet volume by day

Executive summary

A single fabricated AWS key, planted in a fake .env file, was used 22,818 times by 84 distinct sources over four days. That is the whole story of this period, and it is a different story from the one the first alert suggested.

The credential did not simply leak into one operator's hands. Sorting the consumers by which API calls they made produces seven distinct behavioural groups, each wanting something different from the same key:

The dominant consumer by four orders of magnitude is 192.253.248.142 (AS213790, Kerkrade NL), which made 21,931 calls — 94% of all activity — almost entirely ses:GetSendQuota. That API returns how many emails an account may send per day. It is the single number that determines whether a compromised account is worth anything to a spam operation.

It ran for 99 consecutive hours without a gap, averaging 230 calls per hour, and it has not stopped. More interesting: it re-fetched the source .env file from the web sensor 3,248 times during the same window. It is not working from a stored copy. Every check re-reads the credential from the origin, which means the operator treats the source URL as the record rather than the key itself.

Two consumer groups are worth separating from the noise. Nineteen sources went after Bedrock, calling ListFoundationModels to enumerate available models before attempting Converse or InvokeModel. And a cluster of 24 hits arrived from 24 different US consumer mobile addresses — T-Mobile, AT&T, Verizon, Charter — inside 41 minutes, all calling GetAccount, all with the same Boto3 user-agent down to the kernel version. One tool, distributed across residential mobile IPs, presumably to avoid the rate-limiting a single address would attract.

On the shell sensor, the PUBKEY signal fired 64 times having fired zero times in eight days of July baseline. Two separate causes, described below, and one of them is the return of a key first seen in July.

Notable sessions — honeytoken

Notable sessions — SSH and telnet

What the decoys are actually catching

3,585 config-file retrievals from 56 sources this period, against zero in the six days before the decoys existed. The distribution is lopsided in the same way the token activity is: 3,384 of them are /.env, and 3,248 of those are the SES checker re-reading its own source.

Excluding that host leaves roughly 340 retrievals from 55 sources — about 70 per day from genuinely distinct actors. That is the honest measure of how often an exposed .env is picked up on a host nobody has any reason to target.

Indicators

Honeytoken consumers by objective

TechTies Inc. also hosts the coordinated SSH brute-force quota group observed since July.

Payload hosts

Busiest shell sources

Payload hashes

MITRE ATT&CK mapping