Hi tusksm! It's honeypot season! Really cool project, I've been working on a honeypot project of my own right now called `honeyprompt` (https://github.com/alectrocute/honeyprompt) that utilizes LLMs to craft responses and supports multiple protocols. Having a public sink presentation layer like honeypotlive.cc was one of my next todos.
For the sake of interest you could try to expose periodically rotated keyed hashes of IPs and credentials instead of the raw values. It would still let people correlate events within a limited time window
You know what extra data would be cool? If you hit `curl https://ip.guide/{src_ip}` and got back the ASN and country etc and added a leaderboard. In my own experiments in this area I've been gobsmacked by how much malicious traffic comes from Azure.
I maintain several web servers and kept seeing a constant stream of SSH login attempts. At some point I became curious: what do these bots actually try to do after they get in?
I set up a Cowrie SSH honeypot and built a small live dashboard around its JSON logs. Cowrie listens on port 22, a Python service follows the log and streams events over WebSockets, and Nginx serves the frontend. The whole thing currently runs on a 1 vCPU / 1 GB Debian VPS.
The dashboard groups activity by source IP, with individual SSH sessions nested underneath. It shows authentication attempts, commands, SSH client fingerprints, file writes and downloads, and tunneling requests in real time.
Initially I thought the interesting part would be simply watching commands appear. After looking at the collected data, I realized that recurring behavior is much more interesting than individual events.
In one roughly 8-hour sample, the honeypot recorded about 1,950 sessions from 213 source IPs. 327 sessions reached command execution.
Some recurring patterns included:
- the same SSH public key being installed 152 times from 11 source IPs
- a system fingerprinting script that appears designed to distinguish a real shell from a honeypot
- a downloader requesting payloads for several CPU architectures
- attempts to use SSH forwarding as a proxy
- distributed credential probes that connect, test one value, and immediately disconnect
This also showed me that grouping activity only by IP isn't enough. Several apparently different sources can use the same SSH client fingerprint, command sequence, public key, or downloaded artifact and probably belong to the same automated campaign.
At the moment this is primarily a live log viewer. Some directions I am considering are:
- automatic classification of sessions as scanning, credential probing, reconnaissance, persistence, downloading, or tunneling
- clustering activity into campaigns using HASSH fingerprints, command sequences, SSH keys, and artifact hashes
- historical statistics and searchable sessions
- support for multiple distributed honeypot sensors
- publishing the collector and dashboard code
The public stream currently includes source IPs, attempted credentials, and commands. I added a notice explaining that an IP may belong to a compromised machine, proxy, VPN, or scanner, but I am still thinking through the privacy and responsible-disclosure tradeoffs.
Cowrie's "login.success" events only mean that the honeypot accepted the credentials; they don't mean those credentials would work on a real server.
I'm trying to decide whether this should remain a simple live visualization or grow into a small analysis tool.
Which direction would make this project most useful or interesting to you? Are there other patterns or types of analysis that would be worth adding?
Some kind of source IP masking would be prudent. As you pointed out, some of those machines are compromised, and you aren't making their owners' lives any easier.
Bad actors might use the data you're publishing to fingerprint specific exploits to which the machines are vulnerable, multiplying the problem.
If producing an IP blacklist is one of your aims, divorcing it from any specific traffic would be more responsible.
You may also want to consider the risk traffic from compromised machines could leak PII (eg. say a script tried to use you as a relay to exfiltrate data) - and the ethical and legal consequences. A filter for SIN, credit cards, etc. would be a basic table-stakes mitigation step.
> Some kind of source IP masking would be prudent. As you pointed out, some of those machines are compromised, and you aren't making their owners' lives any easier.
Hard for me to find much sympathy for negligent users who unintentionally allowed their home computers or phones to join a malicious botnet, or their ISPs who aren't stopping the activity. Even if it is my own grandma's PC.
I agree about the content though, there probably are a lot of actually innocent victims' personal information in the traffic itself.
Easy for you to say, assuming your PC is clean. I don't think negligent is the right word though. Ignorant maybe? Or some form of naivety? The negligence might be on software or hardware vendors, but grandma isn't to blame for the problem.
when you read or are told not to click on that link in the e-mail, or open the attachment, you should fire up your monitor while you are clicking on the links.
it might be interesting to have an eye on this while you are talking to the phone scammer.
We don’t have static IPs at home in Romania. A restart of the router will just give that person another public IP and they won’t notice any repercussions.
They are leaking their IP on the internet! Big security no-no. They'll need to download a lot more ram to deal with all the hackers coming for them.
A data broker is going to correlate this IP with "never gonna give you up" as an ideological statement about his drug dealings. They'll be receiving weird ads for weeks!
>Nah, Spur (a company tracking residential proxies) doesn't flag it at all.
I looked into it and so far as I can tell it works off a blacklist system, rather than any sort of automatic analysis (eg. TCP or MTU fingerprinting). If you set up a "residential proxy" in the form of a home VPN, it won't be detected. It also means the detection is only as good as whatever their backlist source is. If it's a niche provider, it might not get picked up at all.
They're not doing a very good job at it, tried a few disposable free residential proxies - not flagged. Tried my CGNAT home connection - flagged. My phone connection - also flagged.
Hi tusksm! It's honeypot season! Really cool project, I've been working on a honeypot project of my own right now called `honeyprompt` (https://github.com/alectrocute/honeyprompt) that utilizes LLMs to craft responses and supports multiple protocols. Having a public sink presentation layer like honeypotlive.cc was one of my next todos.
Its always wild seeing the sheer volume of background noice on public IPs. Fun project.
fun to watch until the ssh user input exploits the web interface :P
Someone instantly started spamming the bee movie's introduction. Solid pun.
For the sake of interest you could try to expose periodically rotated keyed hashes of IPs and credentials instead of the raw values. It would still let people correlate events within a limited time window
You know what extra data would be cool? If you hit `curl https://ip.guide/{src_ip}` and got back the ASN and country etc and added a leaderboard. In my own experiments in this area I've been gobsmacked by how much malicious traffic comes from Azure.
In my own experiments in this area I've been gobsmacked by how much malicious traffic comes from Azure.
I'm currently fighting this battle.
As of this morning:
Closer to 95% if you count Teams.
Mine is very similar, but with DO and AWS swapped around.
Watching the first few minutes was more educational than I expected.
reminds me of https://xkcd.com/350/
Looks cool!
lol @ the person spamming Never Gonna Give You Up
Hi HN,
I maintain several web servers and kept seeing a constant stream of SSH login attempts. At some point I became curious: what do these bots actually try to do after they get in?
I set up a Cowrie SSH honeypot and built a small live dashboard around its JSON logs. Cowrie listens on port 22, a Python service follows the log and streams events over WebSockets, and Nginx serves the frontend. The whole thing currently runs on a 1 vCPU / 1 GB Debian VPS.
The dashboard groups activity by source IP, with individual SSH sessions nested underneath. It shows authentication attempts, commands, SSH client fingerprints, file writes and downloads, and tunneling requests in real time.
Initially I thought the interesting part would be simply watching commands appear. After looking at the collected data, I realized that recurring behavior is much more interesting than individual events.
In one roughly 8-hour sample, the honeypot recorded about 1,950 sessions from 213 source IPs. 327 sessions reached command execution.
Some recurring patterns included:
- the same SSH public key being installed 152 times from 11 source IPs - a system fingerprinting script that appears designed to distinguish a real shell from a honeypot - a downloader requesting payloads for several CPU architectures - attempts to use SSH forwarding as a proxy - distributed credential probes that connect, test one value, and immediately disconnect
This also showed me that grouping activity only by IP isn't enough. Several apparently different sources can use the same SSH client fingerprint, command sequence, public key, or downloaded artifact and probably belong to the same automated campaign.
At the moment this is primarily a live log viewer. Some directions I am considering are:
- automatic classification of sessions as scanning, credential probing, reconnaissance, persistence, downloading, or tunneling - clustering activity into campaigns using HASSH fingerprints, command sequences, SSH keys, and artifact hashes - historical statistics and searchable sessions - support for multiple distributed honeypot sensors - publishing the collector and dashboard code
The public stream currently includes source IPs, attempted credentials, and commands. I added a notice explaining that an IP may belong to a compromised machine, proxy, VPN, or scanner, but I am still thinking through the privacy and responsible-disclosure tradeoffs.
Cowrie's "login.success" events only mean that the honeypot accepted the credentials; they don't mean those credentials would work on a real server.
I'm trying to decide whether this should remain a simple live visualization or grow into a small analysis tool.
Which direction would make this project most useful or interesting to you? Are there other patterns or types of analysis that would be worth adding?
Some kind of source IP masking would be prudent. As you pointed out, some of those machines are compromised, and you aren't making their owners' lives any easier.
Bad actors might use the data you're publishing to fingerprint specific exploits to which the machines are vulnerable, multiplying the problem.
If producing an IP blacklist is one of your aims, divorcing it from any specific traffic would be more responsible.
You may also want to consider the risk traffic from compromised machines could leak PII (eg. say a script tried to use you as a relay to exfiltrate data) - and the ethical and legal consequences. A filter for SIN, credit cards, etc. would be a basic table-stakes mitigation step.
> Some kind of source IP masking would be prudent. As you pointed out, some of those machines are compromised, and you aren't making their owners' lives any easier.
Hard for me to find much sympathy for negligent users who unintentionally allowed their home computers or phones to join a malicious botnet, or their ISPs who aren't stopping the activity. Even if it is my own grandma's PC.
I agree about the content though, there probably are a lot of actually innocent victims' personal information in the traffic itself.
Easy for you to say, assuming your PC is clean. I don't think negligent is the right word though. Ignorant maybe? Or some form of naivety? The negligence might be on software or hardware vendors, but grandma isn't to blame for the problem.
I disagree personally. If these IPs are being used to attempt to gain unauthorized access, it's better to make the public aware, imo.
when you read or are told not to click on that link in the e-mail, or open the attachment, you should fire up your monitor while you are clicking on the links.
it might be interesting to have an eye on this while you are talking to the phone scammer.
Hi, this is very interesting, thanks. While trying to educate myself about honeypots I came across this (https://securehoney.net/).
The aggregations of popular logins and IP locations seem interesting.
From that site:
I wonder what 3 files were so common that they were uploaded 17,787 times instead of malware.Probably the ssh key
This is great. Thanks.
Try fingerprinting the behaviour in the sessions. Over time you should be able to distinguish between various automated tools and live people.
you could make the logs public too :)
There's a guy trying to take down the server by sending as user/pass the lyrics of Rick Astley's "never gonna give you up"
From his home IP... very smart. https://ipinfo.io/86.120.252.156
We don’t have static IPs at home in Romania. A restart of the router will just give that person another public IP and they won’t notice any repercussions.
Why is it not smart?
They are leaking their IP on the internet! Big security no-no. They'll need to download a lot more ram to deal with all the hackers coming for them.
A data broker is going to correlate this IP with "never gonna give you up" as an ideological statement about his drug dealings. They'll be receiving weird ads for weeks!
Probably a relay through a "free" app installed on someone's phone or "smart" TV.
Nah, Spur (a company tracking residential proxies) doesn't flag it at all.
He's most likely just not very smart.
>Nah, Spur (a company tracking residential proxies) doesn't flag it at all.
I looked into it and so far as I can tell it works off a blacklist system, rather than any sort of automatic analysis (eg. TCP or MTU fingerprinting). If you set up a "residential proxy" in the form of a home VPN, it won't be detected. It also means the detection is only as good as whatever their backlist source is. If it's a niche provider, it might not get picked up at all.
They're not doing a very good job at it, tried a few disposable free residential proxies - not flagged. Tried my CGNAT home connection - flagged. My phone connection - also flagged.
Maybe he is doing it for fun and not actually trying to hack the website with Rick Astley lyrics?
IP is clean, most likely will pass any filtering. https://proxybase.xyz/ip/86.120.252.156
So we're getting Rickrolled?