Honeypots on Pablo Seoane · Pentester & Security Researcher

Weekly Threat Intelligence Report — T-Pot Honeypot (Aug 2–9, 2026)

Mon, 10 Aug 2026 00:00:00 +0000

Fifth weekly report from the T-Pot honeypot, period August 2–9, 2026. Volume rises to ~2,814,000 events. The residential ConPot botnet reaches its third consecutive week with now-global reach (NTT DOCOMO, Wind Tre, Bouygues Telecom joining the already known Comcast, AT&T, Charter). RDPHoneypot nearly matches its historical maximum driven by a new actor: Datacamp Limited. Cowrie sees a cryptocurrency credential wave and a new malware family named iran for the first time. And the Adbhoney campaign tracked since the first report — 110→228→287→102 downloads — closes definitively.

Period analyzed: August 2–9, 2026 Source: T-Pot (multi-honeypot + ELK Stack) — publicly internet-exposed instance Classification: Portfolio use / TLP:CLEAR Previous reports: Jul 7–11 · Jul 12–18 · Jul 19–25 · Jul 26–Aug 2

Weekly Threat Intelligence Report — T-Pot Honeypot (Jul 26 – Aug 2, 2026)

Mon, 03 Aug 2026 00:00:00 +0000

Fourth weekly report from the T-Pot honeypot, period July 26 – August 2, 2026. With four weeks of accumulated data, patterns stop being anecdotal and become trends: the residential SNMP botnet on ConPot is confirmed for a second consecutive week (Comcast, AT&T, Verizon, Charter with not a single VPS in the top 10), IP 91.199.133.133 catalogued in ThreatFox as a Mirai Katana C2 reappears serving payloads in Cowrie, Redtail adds RISC-V architecture, and the brute force campaign against Turkish ERP software in Dionaea is confirmed with a second week of consistent data.

Period analyzed: July 26 – August 2, 2026 Source: T-Pot (multi-honeypot + ELK Stack) — publicly internet-exposed instance Classification: Portfolio use / TLP:CLEAR Previous reports: Jul 7–11 · Jul 12–18 · Jul 19–25

Weekly Threat Intelligence Report — T-Pot Honeypot (Jul 19–25, 2026)

Sun, 26 Jul 2026 00:00:00 +0000

Third weekly report from the T-Pot honeypot, period July 19–25, 2026. Total volume drops to ~1,820,000 events (half of last week), but the relevant data isn’t the total — it’s the composition: ConPot spikes x27 with origin in residential ISPs (Comcast, AT&T, Virgin Media, Free SAS) — the signature of a domestic router botnet attacking SNMP, a qualitatively different actor from anything seen so far. Meanwhile, Flyservers S.A. collapses on RDP, the same Adbhoney payload is in its third week of growth, and Dionaea detects brute force specifically targeting Turkish accounting software over MSSQL.

Period analyzed: July 19–25, 2026 Source: T-Pot (multi-honeypot + ELK Stack) — publicly internet-exposed instance Classification: Portfolio use / TLP:CLEAR Previous reports: Jul 7–11 · Jul 12–18

Weekly Threat Intelligence Report — T-Pot Honeypot (Jul 12–18, 2026)

Sun, 19 Jul 2026 00:00:00 +0000

Second weekly report from the T-Pot honeypot, period July 12–18, 2026. Total volume spikes to ~3,213,000 events (x3.2 compared to the previous week), but growth is not uniform: it’s almost entirely explained by two sensors — RDPHoneypot x20.7 with Flyservers S.A. as the dominant source, and Sentrypeer x9.3 with a target shift toward UK numbering. Recurring actors are confirmed across multiple sensors, and a new loader compiled for unusual architectures (loongarch64, m68k) is identified.

Period analyzed: July 12–18, 2026 Source: T-Pot (multi-honeypot + ELK Stack) — publicly internet-exposed instance Classification: Portfolio use / TLP:CLEAR Previous report: week of July 7–11, 2026

Weekly Threat Intelligence Report — T-Pot Honeypot (Jul 7–11, 2026)

Sun, 12 Jul 2026 00:00:00 +0000

First weekly report from the T-Pot honeypot. During the week of July 7–11, 2026, approximately 1,011,000 attack events were recorded across 10 active sensors. Top findings: multi-architecture Redtail malware captured in Cowrie, a complete Android infection chain in Adbhoney (Rebirth → UFO miner → Trinity botnet), active scanning of exposed AI services (Ollama, Gradio, Streamlit), and probing of the IEC-104 protocol used in European electrical substations.

Period analyzed: July 7–11, 2026 Source: T-Pot (multi-honeypot + ELK Stack) — publicly internet-exposed instance Classification: Portfolio use / TLP:CLEAR

I Captured a Rebirth Botnet Sample in My Honeypot: Here's What I Pieced Together

Thu, 09 Jul 2026 00:00:00 +0000

While reviewing traffic from my T-Pot honeypot I found something more interesting than the typical SSH brute-force attempt: a complete infection chain, captured live, that turned out to be a variant of the Rebirth botnet, from the Mirai/Gafgyt family. This post covers exactly what I captured, how I pieced it together to identify it, and what the security community says about this family — making clear throughout what is my direct observation and what is third-party research.

What I Captured (this part is mine)
#

The honeypot that recorded this was Adbhoney, one of T-Pot’s sensors that simulates the ADB (Android Debug Bridge) protocol — Android’s remote debugging system, which when exposed to the internet without authentication is a trivial entry point for automated bots.

I Set Up a Honeypot and I'm Going to Report What I See Every Week

Wed, 08 Jul 2026 00:00:00 +0000

I’m going to intentionally expose a server to the internet so it gets attacked — and then write about it here, every week. No simulations or lab data: real malicious traffic, from the real internet, against a server that does nothing but wait for someone to try to break in.

What This Is
#

This blog documents what a honeypot — a decoy system designed to look vulnerable and attract attacks — detects in real time, week by week.