HONEYPOT REPORT // 2026-08-26 – 2026-08-30

2026-08-26 – 2026-08-30 — SSH, Telnet + Web Honeypot Report

period 2026-08-26 – 2026-08-30
sensors Cowrie SSH/telnet + web deception panel
host VPS · containerized

SSH TELNET WEB KEY ROTATION TRUFFLEHOG

SSH + TELNET SESSIONS

35,253

5 days

UNIQUE SOURCES

1,789

shell sensor

AUTH ATTEMPTS

37,836

3,729 succeeded

PAYLOAD RETRIEVALS

444

22 uploads

WEB REQUESTS

20,853

773 unique IPs

NEW TOKEN CONSUMERS

not seen before

SSH and telnet volume by day

3,395

08-26

8,581

08-27

9,084

08-28

5,750

08-29

8,443

08-30

Executive summary

Volume normalises after the previous period's single-host spike — 35,253 sessions across five days with no day exceeding 9,100. The composition shifts though: telnet rises to 9,108 sessions from 6,337, while SSH falls from 44,180 to 26,145. The client banner distribution flips with it, libssh_0.9.6 overtaking SSH-2.0-Go as the most common.

The CLI-escape credential pattern intensified. enable\0 / linuxshell\0 and system\0 / shell\0 now account for 6,977 attempts between them, more than double the previous period, and they sit well above every genuine credential pair.

The hourly key-rotation host 139.19.117.129 resumed on August 27 and ran through the period, offering a freshly generated public key on a strict sixty-minute cycle and running no commands. Sixty distinct keys this period. Whatever this is, it has now been running intermittently for two weeks.

The most informative detail came from the token log rather than the sensors. A consumer at 34.34.229.83 presented TruffleHog as its user-agent — the open-source secret scanner. It is the first direct evidence of how the planted credential is being discovered: automated secret-scanning against harvested content, not manual inspection. A second consumer had done the same on August 19.

Sixty-six previously unseen token consumers appeared, with Bedrock model enumeration (ListFoundationModels, 25) now the leading novel behaviour — overtaking the SES quota checks that dominated earlier periods.

Notable sessions

2026-08-27 → 08-30 KEY ROTATION 139.19.117.129

Resumed the strict hourly cycle: one session per hour, a newly generated public key each time, zero commands issued.

offers: 60 distinct fingerprints this period
interval: 60.0 minutes, held across the full span
client: SSH-2.0-Go on every session
commands: none — not one session issued a command
assessment: a new keypair cannot be guessed, so this is not brute force; reads as a reachability monitor that discards its key each cycle

2026-08-29 SECRET SCANNER 34.34.229.83

A token consumer identifying itself as TruffleHog, the open-source secret-scanning tool.

user-agent: TruffleHog
event: GetCallerIdentity
significance: direct evidence of the discovery mechanism — automated secret scanning rather than manual reading
prior: the same user-agent appeared from 179.61.227.59 on 2026-08-19

2026-08-26 → 08-30 CLI ESCAPE distributed

Vendor shell-escape sequences submitted as credentials more than doubled.

enable\0/linuxshell\0: 3,489 attempts
system\0/shell\0: 3,488 attempts
genuine credentials below them: admin/admin 539, root/xc3511 480, root/vizxv 443

Protocol shift

Telnet sessions rose 44% while SSH fell 41%. Taken with the credential pattern — vendor CLI escapes rather than passwords — the period reads as a shift toward embedded-device targeting. The loaders being fetched support that: twget.sh from 2.26.136.128 accounts for 127 of 444 retrievals, and it is a Mirai fork that sets hostname TOASTER.

Indicators

Busiest shell sources

source	sessions
92.204.138.51	3,020
92.204.138.198	2,447
91.92.42.126	1,570
45.156.87.93	785
85.11.167.127	785
45.153.34.181	785
172.94.9.55	776
213.177.179.79	744

Payload URLs

url	retrievals
hxxp://2.26.136.128/twget.sh	127
hxxp://185.93.89.72/wget	28
hxxp://5.182.210.174/ok	7

Most attempted credentials

username	password	attempts
`enable\0`	`linuxshell\0`	3,489
`system\0`	`shell\0`	3,488
`admin`	`admin`	539
`root`	`xc3511`	480
`root`	`admin`	467
`root`	`vizxv`	443
`support`	`support`	335
`root`	`123456`	313
`root`	`root`	301
`root`	`888888`	255

Web sensor — most probed paths

path	requests
`/fetch`	198
`/index.php`	96
`/proxy`	84
`/wp-admin/install.php`	74
`/robots.txt`	68
`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	36
`/.git/HEAD`	31
`/login`	26

Payload hashes

sha256	what it is
94f2e4d8d4436874785cd14e6e6d403507b8750852f7f2040352069a75da4c00 virustotal →	`sshd` — Go worm, PAM credential theft, dual miner, Discord C2 (7 uploads)

MITRE ATT&CK mapping

ID	technique	observed as
T1110.001	Brute Force: Password Guessing	37,836 attempts, Mirai default set prominent
T1059.004	Command and Scripting Interpreter: Unix Shell	6,977 vendor CLI escape submissions through the login fields
T1021.004	Remote Services: SSH	60 throwaway public keys offered on a strict hourly schedule from a single host
T1589.001	Gather Victim Identity Information: Credentials	A token consumer identifying as TruffleHog — automated secret scanning as the discovery path
T1526	Cloud Service Discovery	`ListFoundationModels` the leading novel token behaviour, 25 new sources
T1105	Ingress Tool Transfer	444 retrievals, 127 of them the TOASTER Mirai fork

<< prev cd .. next >>