Honeypot

The honeypot runs several sensors at once, each impersonating a different service: SSH, Telnet, FTP, RDP, Elasticsearch, Redis, and a web server.

The SSH and Telnet sensors are built on Cowrie, a widely used honeypot that hands the attacker a convincing fake shell, accepts a login, and then records every command they type without running any of it.

The FTP, RDP, Elasticsearch, and Redis sensors are custom built to do the same as Cowrie but for their own protocols. They aim to stay believable long enough to keep a scanner or potential attacker busy.

The web server is a small web app I built to look like a real business portal, and it is deliberately full of weak spots. Login pages to brute-force, input fields that appear to be wide open to SQL injection, and pages that appear to leak things they shouldn't. There is no real database or system behind any of it, so there is nothing to actually break into.

Everything gets logged in full: the usernames and passwords tried, the commands run after a login is accepted, the paths and payloads sent to the web app, and any file an attacker tries to drop on the machine.

Not every source that trips a sensor gets reported. A single stray probe or one failed login is just background noise, so it is ignored. An address is only reported once it does something genuinely hostile: hammering a login with a burst of guesses, running commands after a break-in, trying to drop a file, or knocking on the sensors again and again the way a scanner does. That bar keeps every report high-confidence.

Not everything scanning the internet is malicious. Research projects like Censys, Shodan, and Shadowserver are constantly scanning the entire internet. The honeypot recognizes these by their known address ranges and reverse-DNS names and deliberately leaves them out of the reports to avoid false positives. They still show up in the visitor counts on this page, but they are never reported.

Whatever clears that bar is reported to public abuse databases like AbuseIPDB and IPThreat, so any attackers end up flagged and blocked on networks that rely on those databases. You can see everything the honeypot has reported on my AbuseIPDB profile and my IPThreat profile.

A honeypot is only useful if it is actually up. Every time the reporter finishes a cycle, and every time these stats are published, the job checks in with Healthchecks.io. Healthchecks expects those check-ins on a schedule and warns me over email if the honeypot is down.

The running totals are published as a few JSON files stored on Cloudflare R2, which this page then reads live in your browser.