One decoy server. SSH and Telnet exposed to the open internet. Every unsolicited interaction counted.
HELSINKI, FINLANDHunang was an unannounced Cowrie honeypot. It emulated a shell and recorded automated traffic sent to one public host. The first recorded attack followed the sensor launch by 23 seconds. What followed was persistent, mostly routine scanning and credential guessing.
Cumulative counts through 2026-09-25 14:52 UTC. A successful honeypot login means the decoy let a visitor into its simulated shell; it does not mean a real server was compromised.
The daily series covers the whole captured period, including days older than the 30-day raw-event retention window. The highest day, 2026-08-28, logged 38,737 attempts—about 5.0 times the median complete day (7,800). A daily peak cannot by itself identify one botnet or campaign.
Three top credential pairs contain literal \x00 markers and command-like text such as /bin/busybox UNSTABLE. Together they account for at least 106,322 attempts (23.6%). Treating every credential row as a human-readable password dictionary would hide this distinct automated behavior. The rollup cannot prove the underlying exploit or the tool that sent it.
The United States and Netherlands account for 65.4% of recorded login attempts. This is where observed network endpoints geolocated, not evidence that operators lived there. Hosted infrastructure, relays, and infected devices can all affect this distribution.
The decoy accepted 20,633 logins and recorded 154,407 commands. The classifier also counted 6,993 tool-transfer events and 1,441 authorized-key manipulation events. Those counts indicate observed actions in an emulated environment; they do not establish distinct attackers or successful malware execution.
These are defensive implications of the observed behavior, not measured outcomes of an intervention. Hunang did not run a controlled test of each defense.
Put SSH behind a VPN, bastion, or source allowlist where possible. The sensor was found quickly because its login service answered on the public internet.
Use key-only SSH authentication and disable or change factory credentials before first exposure. Repeated defaults and simple guesses filled the leaderboard.
Some sessions moved on to discovery, payload-transfer, and persistence-like actions in the decoy shell. Egress controls and alerts for unexpected commands help limit damage if authentication fails.
Cowrie emulated SSH and Telnet on an isolated VPS. A shipper forwarded events to an authenticated ingest API. Source IPs were replaced at ingest by a keyed pseudonym and a truncated network prefix. The public site received only aggregate rollups. The 23-second delay compares the recorded sensor-live timestamp with the first captured event.
Lifetime totals, leaderboards, and daily buckets survive the 30-day event purge. The 24-hour IPv4/IPv6 counts and 48-hour hourly series are windowed observations and are excluded from the long-term conclusions here. ATT&CK counts represent classified events; categories may overlap and must not be summed as incidents.
This is one sensor at one address, over one period. It is a case study of traffic that reached that sensor, not an estimate of the whole internet or a list of people behind the traffic. GeoIP data came from DB-IP Lite under CC BY 4.0. Read the data handling policy ↗
Daily activity, source countries, credentials, client banners, and observed techniques from the dated anonymous rollup snapshot.