1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
|
# Honeylabs Telemetry Data
## ASN 215540 Enrichment (30 days: May 9 - Jun 9)
- Total events: 724
- Unique source IPs: 21
- First seen: 2026-05-09T08:51:23
- Last seen: 2026-06-09T10:48:20
### Top Ports Targeted
80, 443, 22, 2087, 2375, 2086, 5002, 2222, 2443, 18789
### Source Countries
FI (Finland), NL (Netherlands), NO (Norway), FR (France), US (United States)
### Top Source IPs
178.17.53.215 (278 events)
89.185.81.112 (95 events)
5.253.59.171 (48 events)
147.45.50.147 (48 events)
147.45.50.171 (47 events)
147.45.50.108 (47 events) -- GreyNoise MALICIOUS admin panel
194.87.216.198 (46 events)
109.172.55.64 (46 events) -- Same SSH build as target IPs
78.153.155.71 (18 events)
178.130.47.195 (17 events)
## ASN 215540 Enrichment (90 days: Mar 11 - Jun 9)
- Total events: 1,973
- Unique source IPs: 58
- Top ports: 443, 80, 1723, 2087, 22, 2375, 2222, 2086, 8443, 25565
- Source countries: NL, FI, US, RU, NO
## IOC Lookups on Target IPs
All three target IPs (92.118.112.230, 89.185.80.144, 89.185.80.183):
- **Total events: 0** (not observed in honeypot data)
- No activity in the retained window on any port/protocol monitored
## Global Attack Timeline (30 days: May 9 - Jun 9)
```
Date Events Unique Sources
2026-05-09 182,677 9,664
2026-05-10 208,198 9,527
2026-05-11 117,326 9,952
2026-05-12 147,346 10,068
2026-05-13 126,539 9,508
2026-05-14 154,697 9,481
2026-05-15 138,283 9,065
2026-05-16 123,784 8,310
2026-05-17 96,388 7,553
2026-05-18 232,171 7,736
2026-05-19 134,117 8,076
2026-05-20 109,114 7,627
2026-05-21 156,160 7,983
2026-05-22 92,009 7,585
2026-05-23 89,882 7,160
2026-05-24 113,648 7,130
2026-05-25 110,080 7,583
2026-05-26 206,768 7,733
2026-05-27 93,606 7,477
2026-05-28 177,479 8,148
2026-05-29 127,072 8,751
2026-05-30 191,029 8,314
2026-05-31 201,908 8,266
2026-06-01 119,234 8,710
2026-06-02 166,775 9,009
2026-06-03 147,398 9,263
2026-06-04 135,744 9,221
2026-06-05 127,141 8,591
2026-06-06 122,880 7,649
2026-06-07 119,033 7,100
2026-06-08 170,475 7,787
2026-06-09 168,843 7,652
```
## Top ASNs by Event Count (90 days)
1. ASN 14061 (DigitalOcean): 1,494,911 events, 13,120 unique IPs
2. ASN 396982 (Google LLC): 1,058,293 events, 5,715 IPs
3. ASN 135377 (UCLOUD HK): 732,199 events, 850 IPs
4. ASN 398705 (Censys Inc): 545,368 events, 16 IPs
5. ASN 202425 (IP Volume inc): 530,594 events, 65 IPs -- same provider type as 215540
|
