# Honeylabs Telemetry Data

## ASN 215540 Enrichment (30 days: May 9 - Jun 9)

- Total events: 724
- Unique source IPs: 21
- First seen: 2026-05-09T08:51:23
- Last seen: 2026-06-09T10:48:20

### Top Ports Targeted

80, 443, 22, 2087, 2375, 2086, 5002, 2222, 2443, 18789

### Source Countries

FI (Finland), NL (Netherlands), NO (Norway), FR (France), US (United States)

### Top Source IPs

178.17.53.215 (278 events)
89.185.81.112 (95 events)
5.253.59.171 (48 events)
147.45.50.147 (48 events)
147.45.50.171 (47 events)
147.45.50.108 (47 events) -- GreyNoise MALICIOUS admin panel
194.87.216.198 (46 events)
109.172.55.64 (46 events) -- Same SSH build as target IPs
78.153.155.71 (18 events)
178.130.47.195 (17 events)

## ASN 215540 Enrichment (90 days: Mar 11 - Jun 9)

- Total events: 1,973
- Unique source IPs: 58
- Top ports: 443, 80, 1723, 2087, 22, 2375, 2222, 2086, 8443, 25565
- Source countries: NL, FI, US, RU, NO

## IOC Lookups on Target IPs

All three target IPs (92.118.112.230, 89.185.80.144, 89.185.80.183):

- **Total events: 0** (not observed in honeypot data)
- No activity in the retained window on any port/protocol monitored

## Global Attack Timeline (30 days: May 9 - Jun 9)

```
Date       Events    Unique Sources
2026-05-09  182,677   9,664
2026-05-10  208,198   9,527
2026-05-11  117,326   9,952
2026-05-12  147,346  10,068
2026-05-13  126,539   9,508
2026-05-14  154,697   9,481
2026-05-15  138,283   9,065
2026-05-16  123,784   8,310
2026-05-17   96,388   7,553
2026-05-18  232,171   7,736
2026-05-19  134,117   8,076
2026-05-20  109,114   7,627
2026-05-21  156,160   7,983
2026-05-22   92,009   7,585
2026-05-23   89,882   7,160
2026-05-24  113,648   7,130
2026-05-25  110,080   7,583
2026-05-26  206,768   7,733
2026-05-27   93,606   7,477
2026-05-28  177,479   8,148
2026-05-29  127,072   8,751
2026-05-30  191,029   8,314
2026-05-31  201,908   8,266
2026-06-01  119,234   8,710
2026-06-02  166,775   9,009
2026-06-03  147,398   9,263
2026-06-04  135,744   9,221
2026-06-05  127,141   8,591
2026-06-06  122,880   7,649
2026-06-07  119,033   7,100
2026-06-08  170,475   7,787
2026-06-09  168,843   7,652
```

## Top ASNs by Event Count (90 days)

1. ASN 14061 (DigitalOcean): 1,494,911 events, 13,120 unique IPs
2. ASN 396982 (Google LLC): 1,058,293 events, 5,715 IPs
3. ASN 135377 (UCLOUD HK): 732,199 events, 850 IPs
4. ASN 398705 (Censys Inc): 545,368 events, 16 IPs
5. ASN 202425 (IP Volume inc): 530,594 events, 65 IPs -- same provider type as 215540