HoneyMire Hub

Attack #291363 telnet

Captured 2026-06-29 17:10:30Z by Ka on honeypot NY1 ⬜ docker-edge · firmware 0.1.0.

Source201.205.247.46:47246
Target port23
Authenticatedyes
Commands2
Duration40.9s

Session recording

Loading session…

Transcript

Server output and attacker input as captured, line-grain. Malware URLs are obscured until sign-in. 

DVRDVS DVR System
Type ? for help

dvrdvs> sh
dvrdvs> /bin/busybox UNSTABLE
UNSTABLE: applet not found
dvrdvs>

Credentials

Username: system

Password: shell

3 login attempt(s) before disconnect.

Geolocation hub-resolved

🇨🇷Costa Rica · Heredia Province · Heredia

Instituto Costarricense de Electricidad y Telecom. · AS11830 Instituto Costarricense de Electricidad y Telecom. · 10.00,-84.15

Network: residential · Instituto Costarricense de Electricidad · Cable/DSL/ISP · peeringdb · medium confidence

Behavioral classification

🦠 80% confidence

Mirai-family IoT botnet — wget + chmod + exec; tries common router/IP-cam credentials.

Matched signals:

Command summary

sh
/bin/busybox UNSTABLE

Reported to threat intel

none

HoneyMire Hub · open feed: / · API: /api · docs: /docs · blocklists: /blocklists · about: /about · firmware: github.com/HoneyMire/HoneyMire