2026-05-19T02:42:26Z https://nostr.ae honeymire https://nostr.ae/npub1a0zv6zcfn35303h7cwye65wd6n347s2t87k7anxkhlu4llazq9yqnwnmaz https://honeymire.org/static/honeymire-logo-512.png https://honeymire.org/static/honeymire-logo-512.png https://nostr.ae/nevent1qqsq4lu7nq4enctrhug86yjyzp206l34c44vnd379ytmhp2ghyd25kqzyr4ufngtpxwxj97xlmpcn823eh2wxh6pfvl6mmkv66lljhll5gq5sxded2p HoneyMire credential leaderboard - today<br/><br/>1. system:shell - 1707 tries<br/>2. support:support - 313 tries<br/>3. solana:solana - 194 tries<br/>4. 0:0 - 168 tries<br/>5. root:xc3511 - 165 tries<br/><br/>Factory defaults age badly.<br/><br/>#CyberSecurity #Honeypot #IoT 2026-05-22T22:31:53Z https://nostr.ae/nevent1qqsgsham4s4cdtuz04sf8ra438akswmktveucqav67uk55x33cpvtaczyr4ufngtpxwxj97xlmpcn823eh2wxh6pfvl6mmkv66lljhll5gq5srcyqq0 HoneyMire pulse / 24h<br/><br/>11981 attempts<br/>746 unique sources<br/>Top port: 23<br/>Most tried login: system:shell<br/><br/>Low effort. High volume. Very internet.<br/><br/>#ThreatIntel #Honeypot #CyberSecurity 2026-05-22T21:01:50Z https://nostr.ae/nevent1qqs2dmdjad34za7qwwr85cg6t6p6d7lxlyjfgkdvemh2ctsy9e8l2eszyr4ufngtpxwxj97xlmpcn823eh2wxh6pfvl6mmkv66lljhll5gq5sn5cq6s New signal source observed<br/><br/>HoneyMire saw activity from Zambia for the first time in 30 days.<br/><br/>Target: TELNET / 23<br/>Behavior: creds-probe<br/>Confidence: 60%<br/><br/>One more ripple in the mire.<br/><br/>#ThreatIntel #Honeypot #CyberSecurity 2026-05-22T19:31:50Z https://nostr.ae/nevent1qqsfjwyvc0wwscmf7x02yexnle48sp3mtv2983rzqeqn29rsy5k0g3qzyr4ufngtpxwxj97xlmpcn823eh2wxh6pfvl6mmkv66lljhll5gq5ssff3z2 New signal source observed<br/><br/>HoneyMire saw activity from Mongolia for the first time in 30 days.<br/><br/>Target: TELNET / 23<br/>Behavior: creds-only<br/>Confidence: 70%<br/><br/>One more ripple in the mire.<br/><br/>#ThreatIntel #Honeypot #CyberSecurity 2026-05-22T03:16:50Z https://nostr.ae/nevent1qqs963wv8uhd6uq8sq4ae6txqaj0p2ktrn5qy6k5u45dsh72703jqugzyr4ufngtpxwxj97xlmpcn823eh2wxh6pfvl6mmkv66lljhll5gq5s3ttvsu Today, Luxembourg was the loudest HoneyMire sensor.<br/><br/>11344 attempts from 1002 unique sources.<br/>Top behavior: scripted<br/><br/>Different country. Same bad passwords.<br/><br/>#ThreatIntel #Honeypot #BlueTeam 2026-05-22T01:46:50Z https://nostr.ae/nevent1qqsp6xdu2rqpttlqv6zxp8eza6w9u2ce96wwqlltfajdxjawnrpxkkczyr4ufngtpxwxj97xlmpcn823eh2wxh6pfvl6mmkv66lljhll5gq5s3sl6ly Bot signal<br/><br/>A HoneyMire sensor saw 11344 attempts from The Netherlands, targeting TELNET / 23.<br/><br/>Credential: system:shell<br/>Pattern: scripted<br/>Confidence: 60%<br/><br/>Small signal, useful noise.<br/><br/>#Honeypot #ThreatIntel #BlueTeam 2026-05-22T00:16:50Z https://nostr.ae/nevent1qqsfujhu35la87ys3rwl5jllpwg8c7cr3ke4gy2hwnuycssrvmmzczgzyr4ufngtpxwxj97xlmpcn823eh2wxh6pfvl6mmkv66lljhll5gq5s3hd58r HoneyMire credential leaderboard - today<br/><br/>1. system:shell - 1535 tries<br/>2. support:support - 302 tries<br/>3. solana:solana - 193 tries<br/>4. 0:0 - 189 tries<br/>5. root:Zte521 - 160 tries<br/><br/>Factory defaults age badly.<br/><br/>#CyberSecurity #Honeypot #IoT 2026-05-21T22:31:50Z https://nostr.ae/nevent1qqswl7qruyqm7xms6cmrjxflkuanzm832jr40uyql37lqn47sq2ajhszyr4ufngtpxwxj97xlmpcn823eh2wxh6pfvl6mmkv66lljhll5gq5s8errd6 HoneyMire pulse / 24h<br/><br/>11343 attempts<br/>1002 unique sources<br/>Top port: 23<br/>Most tried login: system:shell<br/><br/>Low effort. High volume. Very internet.<br/><br/>#ThreatIntel #Honeypot #CyberSecurity 2026-05-21T20:52:19Z https://nostr.ae/nevent1qqsgfzhsf8z8gjgfa0r6nx43laqkyrh6hnxlvvt9lknlh2dnwvchqsqzyr4ufngtpxwxj97xlmpcn823eh2wxh6pfvl6mmkv66lljhll5gq5s2k42fz New signal source observed<br/><br/>HoneyMire saw activity from Cameroon for the first time in 30 days.<br/><br/>Target: SSH / 22<br/>Behavior: scripted<br/>Confidence: 60%<br/><br/>One more ripple in the mire.<br/><br/>#ThreatIntel #Honeypot #CyberSecurity 2026-05-21T19:22:10Z https://nostr.ae/nevent1qqsrtv6vu8j092nen588geufq36uuuvvprapc9cxv0a22qs2hztvqhszyr4ufngtpxwxj97xlmpcn823eh2wxh6pfvl6mmkv66lljhll5gq5scuvayp New signal source observed<br/><br/>HoneyMire saw activity from Nicaragua for the first time in 30 days.<br/><br/>Target: TELNET / 23<br/>Behavior: creds-only<br/>Confidence: 70%<br/><br/>One more ripple in the mire.<br/><br/>#ThreatIntel #Honeypot #CyberSecurity 2026-05-21T03:07:09Z https://nostr.ae/nevent1qqs0mlgn9pwlwht68wu4nvwnvle2d0cf9xsr7vy5d60099q3gn9v55szyr4ufngtpxwxj97xlmpcn823eh2wxh6pfvl6mmkv66lljhll5gq5s44ljkr Strange command spotted by HoneyMire<br/><br/>A bot authenticated and immediately tried:<br/><br/>&#34;echo &#34;===HOSTNAME===&#34;; hostname 2/dev/null || echo EMPTY; echo &#34;===UNAME===&#34;; un&#34;<br/><br/>Pattern:<br/>scripted<br/><br/>Raw payload redacted. Signal preserved.<br/><br/>#ThreatIntel #Honeypot #Malware 2026-05-21T01:37:09Z https://nostr.ae/nevent1qqsgqfccrjqcyxhfvx8f3zt76ndau4enp8v7nr5h7jj79pa8h99tc8czyr4ufngtpxwxj97xlmpcn823eh2wxh6pfvl6mmkv66lljhll5gq5s3mp9ux New signal source observed<br/><br/>HoneyMire saw activity from Macao for the first time in 30 days.<br/><br/>Target: SSH / 22<br/>Behavior: scripted<br/>Confidence: 60%<br/><br/>One more ripple in the mire.<br/><br/>#ThreatIntel #Honeypot #CyberSecurity 2026-05-21T00:07:09Z https://nostr.ae/nevent1qqs0k9du7hmmt7nh734tvmg05jxjc87ms8ppg9hruhhhvhwkllnp0cszyr4ufngtpxwxj97xlmpcn823eh2wxh6pfvl6mmkv66lljhll5gq5s8q5ch0 New signal source observed<br/><br/>HoneyMire saw activity from Guatemala for the first time in 30 days.<br/><br/>Target: TELNET / 23<br/>Behavior: creds-only<br/>Confidence: 70%<br/><br/>One more ripple in the mire.<br/><br/>#ThreatIntel #Honeypot #CyberSecurity 2026-05-20T22:22:09Z https://nostr.ae/nevent1qqsp6k9j6shfpr8ha5sxgtc9xn68x4vqsz80ydr7xwzt3xkes9e7kxczyr4ufngtpxwxj97xlmpcn823eh2wxh6pfvl6mmkv66lljhll5gq5suhsw5x Strange command spotted by HoneyMire<br/><br/>A bot authenticated and immediately tried:<br/><br/>&#34;c � 3������ń{f[�:`���p�+�rH7g�*����r���a�Ì�0��6]�0�]ϔ�V�Y&#34;�${�?ةB�`��?�̰��l�Uo&#34;3&#34;<br/><br/>Pattern:<br/>scripted<br/><br/>Raw payload redacted. Signal preserved.<br/><br/>#ThreatIntel #Honeypot #Malware 2026-05-20T20:52:10Z https://nostr.ae/nevent1qqstf0jvzjex3gk56sf9s88y9gtc00mc7zralsqluzf4vyvfc2a35aqzyr4ufngtpxwxj97xlmpcn823eh2wxh6pfvl6mmkv66lljhll5gq5s60jms7 Today, Luxembourg was the loudest HoneyMire sensor.<br/><br/>12533 attempts from 847 unique sources.<br/>Top behavior: scripted<br/><br/>Different country. Same bad passwords.<br/><br/>#ThreatIntel #Honeypot #BlueTeam 2026-05-20T19:09:46Z https://nostr.ae/nevent1qqsyv3dr6xnnj74rd5xww7336g6ltwfxcvpgvp5jaw07qpugqfqyssczyr4ufngtpxwxj97xlmpcn823eh2wxh6pfvl6mmkv66lljhll5gq5sudgfsk Bot signal<br/><br/>A HoneyMire sensor saw 12533 attempts from The Netherlands, targeting TELNET / 23.<br/><br/>Credential: system:shell<br/>Pattern: scripted<br/>Confidence: 60%<br/><br/>Small signal, useful noise.<br/><br/>#Honeypot #ThreatIntel #BlueTeam 2026-05-20T02:54:46Z https://nostr.ae/nevent1qqs9nqmzndwg6zlywwc44kzkdsxhr34pfldy9lud35wt2hcl39002mqzyr4ufngtpxwxj97xlmpcn823eh2wxh6pfvl6mmkv66lljhll5gq5s880guh HoneyMire credential leaderboard - today<br/><br/>1. system:shell - 3056 tries<br/>2. support:support - 341 tries<br/>3. root:Zte521 - 179 tries<br/>4. solana:solana - 171 tries<br/>5. 0:0 - 164 tries<br/><br/>Factory defaults age badly.<br/><br/>#CyberSecurity #Honeypot #IoT 2026-05-20T01:24:46Z https://nostr.ae/nevent1qqswttusq5hc3pg0dmprj6glqtgh7r466d3a8p0hq9249y86g902sgszyr4ufngtpxwxj97xlmpcn823eh2wxh6pfvl6mmkv66lljhll5gq5sl5yu5s HoneyMire pulse / 24h<br/><br/>12533 attempts<br/>847 unique sources<br/>Top port: 23<br/>Most tried login: system:shell<br/><br/>Low effort. High volume. Very internet.<br/><br/>#ThreatIntel #Honeypot #CyberSecurity 2026-05-19T23:54:46Z https://nostr.ae/nevent1qqspa9x70tjxp7vxqg0xt2hdkl7dnlez3j7us7at0gek79c8ytw97uqzyr4ufngtpxwxj97xlmpcn823eh2wxh6pfvl6mmkv66lljhll5gq5sz9dr8z New signal source observed<br/><br/>HoneyMire saw activity from Cayman Islands for the first time in 30 days.<br/><br/>Target: TELNET / 23<br/>Behavior: creds-only<br/>Confidence: 70%<br/><br/>One more ripple in the mire.<br/><br/>#ThreatIntel #Honeypot #CyberSecurity 2026-05-19T22:09:46Z https://nostr.ae/nevent1qqs23kpu940yrhmfprk85j2eqenrc266n2jg2u7rp8j0qc0dphppq8qzyr4ufngtpxwxj97xlmpcn823eh2wxh6pfvl6mmkv66lljhll5gq5suqumdc Strange command spotted by HoneyMire<br/><br/>A bot authenticated and immediately tried:<br/><br/>&#34;start enable config terminal system linuxshell su shell sh /var/run/.x&amp;&amp;cd /var/&#34;<br/><br/>Pattern:<br/>mirai<br/><br/>Raw payload redacted. Signal preserved.<br/><br/>#ThreatIntel #Honeypot #Malware 2026-05-19T20:39:46Z https://nostr.ae/nevent1qqsyv845v4dfwg694mtt9w0h8asqwfnz33pa44q04f593uxufhway8qzyr4ufngtpxwxj97xlmpcn823eh2wxh6pfvl6mmkv66lljhll5gq5skmpqry New signal source observed<br/><br/>HoneyMire saw activity from Montenegro for the first time in 30 days.<br/><br/>Target: TELNET / 23<br/>Behavior: creds-only<br/>Confidence: 70%<br/><br/>One more ripple in the mire.<br/><br/>#ThreatIntel #Honeypot #CyberSecurity 2026-05-19T18:57:26Z https://nostr.ae/nevent1qqsd5rlavplnunauqgp05j52ag4hkjjcjxgv5frwf3pymjv2x3j3s9gzyr4ufngtpxwxj97xlmpcn823eh2wxh6pfvl6mmkv66lljhll5gq5s85wezr New signal source observed<br/><br/>HoneyMire saw activity from Puerto Rico for the first time in 30 days.<br/><br/>Target: TELNET / 23<br/>Behavior: creds-only<br/>Confidence: 70%<br/><br/>One more ripple in the mire.<br/><br/>#ThreatIntel #Honeypot #CyberSecurity 2026-05-19T02:42:26Z https://nostr.ae/nevent1qqsxhsmhe8u92g2p4un4ms2drednatj6eugeh9pqz9w69p23c5mrqqszyr4ufngtpxwxj97xlmpcn823eh2wxh6pfvl6mmkv66lljhll5gq5s7euc49 New signal source observed<br/><br/>HoneyMire saw activity from Croatia for the first time in 30 days.<br/><br/>Target: TELNET / 23<br/>Behavior: mirai<br/>Confidence: 80%<br/><br/>One more ripple in the mire.<br/><br/>#ThreatIntel #Honeypot #CyberSecurity 2026-05-19T00:57:26Z https://nostr.ae/nevent1qqsdp93u67swzx0xj2hgs8g3fr6hywm2jfl9enq8kkm0fruk5r3hn0szyr4ufngtpxwxj97xlmpcn823eh2wxh6pfvl6mmkv66lljhll5gq5s9y478d Today, Luxembourg was the loudest HoneyMire sensor.<br/><br/>11467 attempts from 1063 unique sources.<br/>Top behavior: scripted<br/><br/>Different country. Same bad passwords.<br/><br/>#ThreatIntel #Honeypot #BlueTeam 2026-05-18T23:27:26Z https://nostr.ae/nevent1qqs27cehmv48asu87pfwnkdxy3xyv5nzr8zqdeeyq7wu22wglux95nszyr4ufngtpxwxj97xlmpcn823eh2wxh6pfvl6mmkv66lljhll5gq5sq7sdve Bot signal<br/><br/>A HoneyMire sensor saw 11467 attempts from The Netherlands, targeting TELNET / 23.<br/><br/>Credential: system:shell<br/>Pattern: scripted<br/>Confidence: 60%<br/><br/>Small signal, useful noise.<br/><br/>#Honeypot #ThreatIntel #BlueTeam 2026-05-18T21:57:27Z https://nostr.ae/nevent1qqs2s8nx6j50wzvgshk4ukxhf2sn88skvpq5j7cq7kjkrsz75jj4ytszyr4ufngtpxwxj97xlmpcn823eh2wxh6pfvl6mmkv66lljhll5gq5sg5ne0s HoneyMire credential leaderboard - today<br/><br/>1. system:shell - 1427 tries<br/>2. support:support - 301 tries<br/>3. admin:1234 - 205 tries<br/>4. 0:0 - 185 tries<br/>5. solana:solana - 182 tries<br/><br/>Factory defaults age badly.<br/><br/>#CyberSecurity #Honeypot #IoT 2026-05-18T20:27:26Z https://nostr.ae/nevent1qqs2a5x5npr7z5qnfng7slfuyl8lzv2kw8ptgs7j36txm760txtzxlczyr4ufngtpxwxj97xlmpcn823eh2wxh6pfvl6mmkv66lljhll5gq5s3d83z8 HoneyMire pulse / 24h<br/><br/>11467 attempts<br/>1063 unique sources<br/>Top port: 23<br/>Most tried login: system:shell<br/><br/>Low effort. High volume. Very internet.<br/><br/>#ThreatIntel #Honeypot #CyberSecurity 2026-05-18T18:55:23Z https://nostr.ae/nevent1qqs80lznzflykmeva42fz9cjhlutcuyx6m7elcj5j8t9gw97u2n4suqzyr4ufngtpxwxj97xlmpcn823eh2wxh6pfvl6mmkv66lljhll5gq5s7qnj5k New signal source observed<br/><br/>HoneyMire saw activity from Slovakia for the first time in 30 days.<br/><br/>Target: SSH / 22<br/>Behavior: scripted<br/>Confidence: 60%<br/><br/>One more ripple in the mire.<br/><br/>#ThreatIntel #Honeypot #CyberSecurity 2026-05-18T02:40:22Z https://nostr.ae/nevent1qqspn9kzyk2hxe9q2gthlue2rtkqv9dpyzsd9nd489seffmzj52cccczyr4ufngtpxwxj97xlmpcn823eh2wxh6pfvl6mmkv66lljhll5gq5s5geg25 Today, Luxembourg was the loudest HoneyMire sensor.<br/><br/>11260 attempts from 1062 unique sources.<br/>Top behavior: scripted<br/><br/>Different country. Same bad passwords.<br/><br/>#ThreatIntel #Honeypot #BlueTeam 2026-05-18T00:55:22Z https://nostr.ae/nevent1qqs2xesywzwn7py4x3lhtqxk5fua9q82jcenle3xvmp8edh3urfxeyqzyr4ufngtpxwxj97xlmpcn823eh2wxh6pfvl6mmkv66lljhll5gq5s54tw9l Bot signal<br/><br/>A HoneyMire sensor saw 10953 attempts from The Netherlands, targeting TELNET / 23.<br/><br/>Credential: system:shell<br/>Pattern: scripted<br/>Confidence: 60%<br/><br/>Small signal, useful noise.<br/><br/>#Honeypot #ThreatIntel #BlueTeam 2026-05-17T23:25:23Z https://nostr.ae/nevent1qqsp2tuys2ezv7hs79zqddaczmcynx3hf6lpqgcvz3v76z7uare8fhszyr4ufngtpxwxj97xlmpcn823eh2wxh6pfvl6mmkv66lljhll5gq5swrte8t HoneyMire credential leaderboard - today<br/><br/>1. system:shell - 1055 tries<br/>2. support:support - 303 tries<br/>3. admin:1234 - 195 tries<br/>4. 0:0 - 187 tries<br/>5. solana:solana - 167 tries<br/><br/>Factory defaults age badly.<br/><br/>#CyberSecurity #Honeypot #IoT 2026-05-17T21:55:22Z https://nostr.ae/nevent1qqszqs6syfredsxfw6wmnjun37kwgg8aytmjxgnhmv482rup32hf04czyr4ufngtpxwxj97xlmpcn823eh2wxh6pfvl6mmkv66lljhll5gq5sz2mapx HoneyMire pulse / 24h<br/><br/>10953 attempts<br/>1145 unique sources<br/>Top port: 23<br/>Most tried login: system:shell<br/><br/>Low effort. High volume. Very internet.<br/><br/>#ThreatIntel #Honeypot #CyberSecurity 2026-05-17T20:25:22Z https://nostr.ae/nevent1qqsvvx9kd57pthyn365twd8yp8g8vyj5tjtt7764fqhrs36erg8zj5szyr4ufngtpxwxj97xlmpcn823eh2wxh6pfvl6mmkv66lljhll5gq5sszvddd Strange command spotted by HoneyMire<br/><br/>A bot authenticated and immediately tried:<br/><br/>&#34;export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH u&#34;<br/><br/>Pattern:<br/>scripted<br/><br/>Raw payload redacted. Signal preserved.<br/><br/>#ThreatIntel #Honeypot #Malware 2026-05-17T18:44:12Z