⚠️ Still Active: This IP was still hitting our honeypot at 06:42 UTC this morning (April 26, 2026). The attack has been continuous for over 24 hours with no sign of stopping. GreyNoise independently confirms it was scanning the internet TODAY.

💡 Pattern: The 125-event count across many IPs suggests rate-limited batches: scan N targets, rotate to new VM. The multi-region deployment (Taiwan, US, Europe, Asia-Pacific) is designed to evade geographic blocking and per-region rate limits. No neighboring IPs have Shodan data — these are ephemeral VMs (created → scan → destroy pattern).

🚩 Critical Finding: The Nmap-SSH2-Hostkey client is especially significant — it's specifically designed to collect SSH host keys for fingerprinting infrastructure. Combined with the uname data, the operator now has: IP address + OS version + kernel version + CPU architecture + SSH host key fingerprint. This is a complete target profile for vulnerability matching.

Threat Classification: Commercial Vulnerability Intelligence Operation

This is an IoT/server inventory operation. The uname output reveals: OS name, kernel version, hostname, and machine architecture. Combined with the SSH host key collection (Nmap-SSH2-Hostkey), the operator is building a database of: "this IP runs Linux [version] on [arch] with [kernel] — here are the CVEs that apply."

Using Google Cloud is strategically deliberate: GCP IP reputation is clean, many firewalls whitelist Google ranges, and GCP's abuse response is notoriously slow for ephemeral VMs. The operator creates instances, scans a batch of targets, destroys the VMs, and repeats — making retroactive investigation difficult.

The repetition of uname 10+ times per session serves a dual purpose: honeypot detection (real systems always return identical output; some honeypots randomize responses between sessions) and reliability validation (ensuring the data collected is consistent and trustworthy).

The multi-region deployment across Taiwan, US, Europe, and Asia-Pacific is designed to: (1) evade geographic blocking rules, (2) bypass per-region API rate limits, and (3) appear as distributed legitimate traffic rather than a centralized scanning operation. The 125-event pattern across many IPs confirms batched, rate-limited scanning — a hallmark of professional reconnaissance infrastructure.

This data is sold on underground markets or used by APT groups to match exploits to specific targets. A database entry might read: "IP 203.0.113.45 → Linux 5.15.0-91-generic x86_64 → vulnerable to CVE-2024-XXXX, CVE-2025-YYYY." The buyer then deploys pre-built exploits against confirmed-vulnerable targets.

The $1,500+/month cloud spend, multi-region deployment, professional libssh tooling, and GreyNoise-confirmed malicious classification all point to a commercially motivated vulnerability intelligence operation — not a hobbyist or researcher.