HONEYPOT REPORT // 2026-08-21 – 2026-08-25

2026-08-21 – 2026-08-25 — SSH, Telnet + Web Honeypot Report

period 2026-08-21 – 2026-08-25
sensors Cowrie SSH/telnet + web deception panel
host VPS · containerized

SSH TELNET WEB VOLUME SPIKE DAREDEVIL

SSH + TELNET SESSIONS

50,517

5 days

UNIQUE SOURCES

1,626

shell sensor

AUTH ATTEMPTS

50,067

2,533 succeeded

PAYLOAD RETRIEVALS

505

15 uploads

WEB REQUESTS

22,235

742 unique IPs

NEW TOKEN CONSUMERS

not seen before

SSH and telnet volume by day

3,140

08-21

30,987

08-22

3,196

08-23

7,383

08-24

5,811

08-25

Executive summary

August 22 carries 30,987 sessions against a baseline near 3,000, and almost all of it is one host. 39.101.69.5 opened 27,024 sessions in a single day — 53% of the period — from an Alibaba Cloud address. Removing it leaves five days that run between 3,100 and 7,400, which is the honest shape of the period.

The credential list has changed character. The top two pairs are not credentials at all: enable\0 / linuxshell\0 and system\0 / shell\0, 1,599 and 1,592 attempts. Those are vendor CLI escape commands being submitted into the username and password fields, null terminators included. The tooling is not guessing passwords, it is trying to break out of an embedded device menu through the login prompt.

Below them sit the IoT defaults that have been constant all summer — root/xc3511, root/vizxv, admin/admin — the standard Mirai credential set.

A new family appeared: daredevil, served from 176.65.139.202 across five ARM and MIPS variants. No x86 build was offered at all. Unlike the spray loaders that fetch eleven architectures and let ten fail, this one ships only for embedded targets — the operator knows what they are aiming at.

On the token side, the SES quota checker at 192.253.248.142 passed its first full week, still re-fetching the source .env roughly 1,030 times a day rather than caching the key. Seventy-two previously unseen consumers appeared during the period, mostly account-profiling calls.

Notable sessions

2026-08-22 VOLUME ANOMALY 39.101.69.5

27,024 sessions in one day from a single Alibaba Cloud host, responsible for over half the period's SSH traffic.

sessions: 27,024 of 50,517
client: SSH-2.0-Go
effect: the daily chart is meaningless without excluding it
note: no payload retrieval followed — volume without delivery

2026-08-21 → 08-25 NEW FAMILY 176.65.139.202

A loader serving five embedded-only architectures under the name daredevil, plus a separate telnet stager.

binaries: daredevil.armv5l, armv6l, armv7l, mips, mipsel
absent: no x86, x86_64, ppc, sparc or sh4 build offered
stager: hxxp://176.65.139.202:80/telnet.sh, 43 retrievals
assessment: targeted at routers, cameras and DVRs specifically rather than sprayed

2026-08-21 → 08-25 CLI ESCAPE distributed

Vendor shell-escape commands submitted as credentials, null terminators intact.

pairs: enable\0/linuxshell\0 (1,599), system\0/shell\0 (1,592)
also: sh\0 / /bin/busybox UNSTABLE\0 (519)
note: the login prompt is being used as a command channel, not an authentication step

The decoy population

5,442 config retrievals from 55 sources, of which 5,067 are the SES checker re-reading its own source. The remaining 375 come from 54 distinct actors — roughly 75 a day, which is the steady-state rate for an exposed .env on a host nobody has a reason to target.

The credential-chain detector has still never fired.

Indicators

Busiest shell sources

source	sessions
39.101.69.5	27,024
164.92.115.22	1,496
92.204.138.44	1,164
91.92.42.168	785
77.239.124.250	785
91.92.42.68	785
91.92.42.61	784
45.156.87.166	773

Payload URLs

url	retrievals
hxxp://2.26.136.128/twget.sh	100
hxxp://176.65.139.202:80/telnet.sh	43
hxxp://185.93.89.72/wget	26
hxxp://176.65.139.202/daredevil.armv7l	26
hxxp://176.65.139.202/daredevil.mips	21
hxxp://176.65.139.202/daredevil.mipsel	21
hxxp://176.65.139.202/daredevil.armv5l	21
hxxp://176.65.139.202/daredevil.armv6l	20
hxxp://176.65.139.202/daredevil.x86_64	19
hxxp://176.65.139.202/daredevil.armv4l	15

Most attempted credentials

username	password	attempts
`enable\0`	`linuxshell\0`	1,599
`system\0`	`shell\0`	1,592
`sh\0`	`/bin/busybox UNSTABLE\0`	519
`admin`	`admin`	356
`root`	`admin`	352
`root`	`xc3511`	218
`root`	`root`	209
`root`	`vizxv`	189
`root`	`123456`	163
`root`	`default`	152

Web sensor — most probed paths

path	requests
`/index.php`	267
`/fetch`	135
`/view.php`	119
`/download.php`	115
`/read.php`	113
`/home.php`	110
`/page.php`	110
`/robots.txt`	85

Payload hashes

sha256	what it is
94f2e4d8d4436874785cd14e6e6d403507b8750852f7f2040352069a75da4c00 virustotal →	`sshd` — Go worm, PAM credential theft, dual miner, Discord C2 (8 uploads)

MITRE ATT&CK mapping

ID	technique	observed as
T1595.001	Active Scanning: Scanning IP Blocks	27,024 sessions from one host in 24 hours with no payload delivery
T1110.001	Brute Force: Password Guessing	50,067 attempts; Mirai default set `root/xc3511`, `root/vizxv`
T1059.004	Command and Scripting Interpreter: Unix Shell	Vendor CLI escapes submitted through the login fields with null terminators
T1105	Ingress Tool Transfer	505 retrievals; daredevil in five embedded architectures from 176.65.139.202
T1552.001	Unsecured Credentials: Credentials In Files	5,442 config decoy retrievals from 55 sources
T1496	Resource Hijacking	Redtail multi-architecture upload set; SES quota polling continues at ~1,030/day

cd .. next >>