HONEYPOT REPORT // 2026-08-31 – 2026-09-04

2026-08-31 – 2026-09-04 — SSH, Telnet + Web Honeypot Report

period 2026-08-31 – 2026-09-04
sensors Cowrie SSH/telnet + web deception panel
host VPS · containerized

SSH TELNET WEB SES CHECKER ENDS

SSH + TELNET SESSIONS

33,794

5 days

UNIQUE SOURCES

1,690

shell sensor

AUTH ATTEMPTS

39,949

4,541 succeeded

PAYLOAD RETRIEVALS

214

47 uploads

WEB REQUESTS

30,827

874 unique IPs

NEW TOKEN CONSUMERS

160

not seen before

SSH and telnet volume by day

6,615

08-31

6,648

09-01

4,990

09-02

10,910

09-03

4,631

09-04

Executive summary

The period's defining event is an absence. 192.253.248.142 — the SES quota checker that had polled the fabricated AWS key continuously since August 18, and re-fetched the source .env roughly a thousand times a day — made its last request on September 2 and has not returned.

Fifteen days, then nothing. From first retrieval on 2026-08-18 to final request on 2026-09-02, one operator checked whether a stolen credential could send email, roughly 230 times an hour, without interruption. Then it stopped. That figure is the useful one: it is a measured lifetime for a credential inside a live checking pipeline, and it is not a number that gets published often.

Whether the key was pruned as dead, the pipeline moved on, or the host was taken down is not visible from here. What is visible is that decoy retrievals fell from 5,514 in the previous period to 3,430, and 2,843 of those were the checker's final three days.

Telnet continued climbing — 12,176 sessions, its highest yet, against 21,618 SSH. The vendor CLI escapes reached 10,640 attempts between the two dominant pairs, and genuine credentials remain entirely IoT defaults.

Web probing nearly doubled to 30,827 requests, with /fetch and /proxy among the most requested paths — open-proxy testing rather than exploitation. Uploads to the shell sensor rose to 47, the highest of any period, with the sshd Go worm accounting for 11 and the Redtail multi-architecture set for the rest.

Notable sessions

2026-09-02 CAMPAIGN ENDS 192.253.248.142

Final request from the SES quota checker after fifteen continuous days of polling.

first seen: 2026-08-18 — 92 seconds after retrieving the decoy
last seen: 2026-09-02
duration: 15 days, no gaps
volume: ~230 API calls/hour sustained; ~1,030 decoy re-fetches per day
behaviour: re-read the source .env on every cycle rather than caching the key
assessment: a measured credential lifetime inside a live checking pipeline

2026-08-31 → 09-04 UPLOAD PEAK distributed

Forty-seven file uploads, the highest of any period, dominated by two familiar families.

sshd: 11 uploads — the Go worm with PAM credential theft and Discord C2
Redtail set: clean.sh, redtail.arm7, redtail.arm8, redtail.i686, 5 each
note: the same operator has been staging this set since July without modification

2026-08-31 → 09-04 PROXY TESTING distributed

Requests to /fetch and /proxy among the most probed paths, checking whether the host will relay traffic.

/fetch: 264 requests
/proxy: 112 requests
objective: open-proxy discovery — a different intent from the exploitation traffic around it

What the ending tells you

The checker never learned the key was fake. Every one of its roughly 80,000 calls returned an authentication failure, and it kept going for fifteen days. That is worth stating plainly: a credential-checking pipeline at this scale does not appear to distinguish between a key that is dead and a key that never existed. It simply retries until some internal timer expires.

The credential-chain detector has still never fired across any period.

Indicators

Busiest shell sources

source	sessions
92.204.138.51	3,545
92.204.138.142	2,568
50.62.181.140	2,560
45.156.87.13	785
45.153.34.149	785
167.172.159.239	277
142.93.218.50	231
166.62.102.109	189

Payload URLs

url	retrievals
hxxp://185.93.89.72/wget	45
hxxp://176.65.139.196/bins/kla.sh	1
hxxp://176.65.139.196/bins/px86	1
hxxp://176.65.139.196/bins/pmips	1
hxxp://176.65.139.196/bins/pmpsl	1
hxxp://139.144.210.113/wget	1

Most attempted credentials

username	password	attempts
`enable\0`	`linuxshell\0`	5,320
`system\0`	`shell\0`	5,320
`root`	`xc3511`	684
`root`	`vizxv`	639
`root`	`admin`	630
`admin`	`admin`	612
`support`	`support`	464
`root`	`123456`	410
`root`	`888888`	405
`root`	`54321`	380

Web sensor — most probed paths

path	requests
`/fetch`	264
`/index.php`	124
`/proxy`	112
`/wp-admin/install.php`	64
`/robots.txt`	63
`/.git/HEAD`	46
`/debug/default/view`	41
`/.env.bak`	36

Payload hashes

sha256	what it is
94f2e4d8d4436874785cd14e6e6d403507b8750852f7f2040352069a75da4c00 virustotal →	`sshd` — Go worm, PAM credential theft, dual miner, Discord C2 (11 uploads)

MITRE ATT&CK mapping

ID	technique	observed as
T1078.004	Valid Accounts: Cloud Accounts	Fifteen-day continuous polling campaign against one planted key ends
T1110.001	Brute Force: Password Guessing	39,949 attempts; IoT default set unchanged
T1059.004	Command and Scripting Interpreter: Unix Shell	10,640 vendor CLI escape submissions
T1090	Proxy	376 requests to `/fetch` and `/proxy` testing for open relay
T1105	Ingress Tool Transfer	214 retrievals; 47 uploads, the highest of any period
T1556.003	Modify Authentication Process: PAM	`sshd` Go worm uploaded 11 times

<< prev cd .. next >>