Estul Lachin

Honeypot

A Cowrie SSH and Telnet honeypot on a small VPS in South China. Every session below is real, unsolicited traffic from the internet: bots guessing passwords and running their first commands on what they think is a server. Stats update hourly; the map replays the last hour. No IP addresses are published.

–Sessions
–Unique sources
–Login attempts
–Commands run
–Countries

Last hour, replayed

Loading…

World map shaded by sessions per country, with each new session drawn as a line from its source to the honeypot. The same numbers are in the Countries table below.
Sessions by country New session (replay) Honeypot

Event feed

    Sessions per day

    What they try

    Countries

    Usernames

    Passwords

    Username / password

    Commands

    SSH clients

    Downloads attempted

    Outbound connections are blocked, so nothing is actually fetched. Hashes link to VirusTotal.

    How it works

    Cowrie listens on ports 22 and 23 and pretends to be a Linux server. It runs in a locked-down container that cannot open outbound connections, so attackers can't use it against anyone else. Every hour a script turns the raw logs into the aggregated JSON this page reads: IP addresses are reduced to country, city and coordinates rounded to about 10 km; URLs and IPs inside commands are defanged (hxxp[:]//). The raw logs stay on the server. Setup, hardening and the aggregation code are in the source repository.