HoneyMire Hub

Attack #291985 telnet

Captured 2026-06-29 19:18:24Z by Ka on honeypot FR1 ⬜ docker-edge · firmware 0.1.0.

Source47.237.76.170:45464
Target port23
Authenticatedyes
Commands2
Duration12.7s

Session recording

Loading session…

Transcript

Server output and attacker input as captured, line-grain. Malware URLs are obscured until sign-in. 

DVRDVS DVR System
Type ? for help

dvrdvs> sh
dvrdvs> /bin/busybox UNSTABLE
UNSTABLE: applet not found
dvrdvs>

Credentials

Username: system

Password: shell

3 login attempt(s) before disconnect.

Geolocation hub-resolved

🇸🇬Singapore · North West · Singapore

Alibaba (US) Technology Co., Ltd. · AS45102 Alibaba (US) Technology Co., Ltd. · 1.35,103.82

Network: cdn · Alibaba · Content · peeringdb · medium confidence

Behavioral classification

🦠 80% confidence

Mirai-family IoT botnet — wget + chmod + exec; tries common router/IP-cam credentials.

Matched signals:

Command summary

sh
/bin/busybox UNSTABLE

Reported to threat intel

none

HoneyMire Hub · open feed: / · API: /api · docs: /docs · blocklists: /blocklists · about: /about · firmware: github.com/HoneyMire/HoneyMire