This page gathers data from my honeypots. For now, only SSH honeypot data is published.

SSH honeypot

I created this SSH honeypot in December 2022 and started collecting data then.

I didn’t deploy a pre-made honeypot. Instead, I studied OpenSSH’s code and patched it to log source IP, username and password for any authentication attempts. For this reason, this honeypot is essentially indistinguishable from an actual OpenSSH server, making it hard to fingerprint.

Published data: (coming soon)

  • Attacker IPs

  • Users

  • Passwords

The graphs below some honeypot stats. Some interesting points:

  • A single honeypot can get tens of thousands of authentications daily

  • The distinct users seen over time has pretty much stagnated

  • New passwords keep being tried regularly

SSH honeypot stats