HONEYPOT REPORT  //  2026-09-05 – 2026-09-09

2026-09-05 – 2026-09-09 — SSH, Telnet + Web Honeypot Report

SSH and telnet volume by day

Executive summary

Two things doubled. SSH sessions rose to 63,735 from 21,618, driven largely by 180.184.86.178 opening 27,860 sessions on September 7 — the second single-host volume spike of the month, again from Chinese cloud infrastructure, again with no payload delivery following it.

The more significant doubling is on the token side. 457 previously unseen consumers exercised the planted AWS key during these five days, against 160 in the period before. And their objective shifted decisively: ListFoundationModels accounts for 201 of the novel events, against 147 for GetSendQuota.

Decoy retrievals collapsed to 576 from 3,430, which is the SES checker's absence showing up directly. Stripped of that one host, the underlying rate from genuine distinct actors is roughly 115 a day across 90 sources — higher source diversity than any prior period even as volume fell.

A new loader family appeared: Sakura from 94.154.43.200, alongside a sora variant from 150.40.127.145 serving arm7, x86 and mips builds. The 94.154.43.x range has now appeared in four separate months across three protocols.

Notable sessions

Where the credential went

With the SES checker gone, the token's consumer population changed shape entirely. Model enumeration is now the leading behaviour by a clear margin, and the client mix widened to include Java and JavaScript HTTP libraries alongside the usual Python tooling.

That breadth is the finding. A single key planted in a single fake config file is being exercised by hundreds of distinct sources running at least six different HTTP client stacks, none of which have any connection to each other beyond having acquired the same string.

Indicators

Busiest shell sources

Payload URLs

Most attempted credentials

Web sensor — most probed paths

Payload hashes

MITRE ATT&CK mapping