root@markcardiff:~/reports$ ./render cowrie-baseline --public-safe
Cowrie SSH Honeypot Baseline
Public-safe test layout for weekly SSH honeypot reporting. Coverage is 9–15 August 2026 UTC. This page intentionally omits raw payload code, attacker key material, detailed transcripts, and sensitive operational details.
30,777Sessions
1,485Unique source IPs
19,232Failed login attempts
9,695Accepted honeypot logins
Observed activity chain
Summary
- Our SSH honeypot observed 30,777 connection sessions from 1,485 unique source IPs during the reporting week.
- Automated login activity was substantial, with 19,232 failed attempts and 9,695 accepted honeypot logins.
- Post-login automation generated 11,467 command events. Most activity was short-lived; median observed session duration was 1.24 seconds.
- The dominant behavior was commodity Linux reconnaissance followed by attempts to modify SSH access, stage files, or clean up competing processes.
Key observations
- SSH automation using Go-based clients dominated the observed client-version strings.
- Repeated command patterns attempted to inspect system details such as kernel, CPU, disk, memory, and network configuration.
- Multiple sessions attempted SSH access manipulation, including removal/recreation of
.sshpaths and insertion of attacker-controlled authorized keys. Public report redacts key material. - Captured file activity included Linux multi-architecture payload naming patterns and a small number of Windows-looking filenames, suggesting broad opportunistic tooling rather than careful target selection.
- The most active source IP was also flagged by VirusTotal with multiple malicious detections, but attribution is not assessed from this data alone.
Activity metrics
| Metric | Value |
|---|---|
| Sessions | 30,777 |
| Unique source IPs | 1,485 |
| Failed login attempts | 19,232 |
| Accepted honeypot logins | 9,695 |
| Command events | 11,467 |
| File download events | 1,480 |
| File upload events | 96 |
Common behavior themes
| Theme | Matching command events |
|---|---|
| recon | 6,643 |
| destructive or evasion | 2,912 |
| persistence | 1,470 |
| mikrotik probe | 26 |
| downloaders | 2 |
Representative observed commands
The following examples are sanitized and shortened where needed:
| Category | Examples |
|---|---|
| System reconnaissance | uname, /proc/cpuinfo, lscpu, df, free, whoami |
| SSH access manipulation | attempts to recreate .ssh and write attacker-controlled authorized keys |
| Cleanup/evasion | attempts to remove temporary scripts, kill processes, or modify host access-control files |
| Router/embedded probing | /ip cloud print style command attempts observed in a small number of sessions |
Selected public-safe indicators
These indicators are provided for defensive awareness. They should not be treated as attribution by themselves.
| Indicator | Context |
|---|---|
| 45.153.34.165 | 939 sessions |
| 91.92.47.55 | 773 sessions |
| 45.156.87.34 | 773 sessions |
| 77.239.124.249 | 773 sessions |
| 91.92.42.61 | 773 sessions |
| http://5.182.210.174/ok | 5 URL observation(s) |
Defensive takeaways
- Internet-exposed SSH services continue to receive high-volume automated credential attacks and immediate post-login automation.
- Defenders should monitor for short-lived SSH sessions followed by system reconnaissance, downloader usage,
.ssh/authorized_keyswrites, and process-kill cleanup patterns. - HASSH/client-version clustering can help separate commodity scanners from more interactive or bespoke activity.
- Honeypot data is useful for trend tracking and detection engineering, but individual source IPs may represent compromised infrastructure, scanners, VPN/proxy nodes, or short-lived cloud hosts.
Limitations
- This report summarizes honeypot telemetry only; it does not imply compromise of production systems.
- VirusTotal enrichment was intentionally limited to conserve quota.
- Public output omits raw payload code, full attacker keys, detailed session transcripts, and sensitive operational details.