The Belgian traffic? Almost entirely from a single residential IP — one box that sent over 156,000 login attempts, more than the entire country of Germany. It just sat there, hammering echo "\x6F\x6B" over and over, every single second, for weeks. Relentless.

Had a funny similar thing, there's some weird person/people that randomly probe and attack a specific game's community hosted dedicated servers; and one week this specific IP address out of Virginia was just hammering one of mine, with what amounts to a specific byte sequence, then an incrementing number of the packet (until it wrapped around). Then it stopped. Weird shit.

Thanks for the warning OP

If they used AI, then I consider they lost all credibility.

Honeypot as a Python script in a docker container?
Isn't that not really a true isolation?

I'm kind of disappointed that bigboobz wasn't on the top of the password list.

Years ago I had a synology NAS that was sleeping itself to death. Support told me open up port 22 and forward the port to the open internet. They would get to and poke around. I told them it was a terrible idea, can I at least set a password?

No. But you can set up ip autoban.

I no longer use synology. I gave it away.

tf is a web scraper engineer, gen ai?

and contains mistakes to that effect

What mistakes?

So is there a socket container for this? Wi wouldn't mind wasting some hacker assholes time with this

Weird I did the exact same thing on a VPS. Basically the same data.

That was an interesting read. I didn't have a lot If knowledge about this topic. So thanks for that!

Was ist using AI for assisted writing? Maybe. But I don't have a Problem with that. I assume everyone ist using it to some extend (me included) and uses it as a tool as any other tool.

The Data is the actual interesting Thing. Would be cool If the author could share his data (of course IP's or other personel information must be anonymized/hashed). If that is made up by AI...Well there goes your credibility. But I don't assume that from the beginning.

What I Learned

1. The internet is loud

Your server isn't special. Nobody is "targeting" it. Every IP address on the internet is being continuously probed by automated systems. Within seconds of exposing port 22, you will receive login attempts. This isn't a question of "if" but "when" — and the answer to "when" is "immediately."

2. Most attackers are dumb

99.6% of the visitors never went beyond a single automated command. They're not hackers — they're scripts running on compromised machines, following instructions from a C2 server, executing the same uname command a million times a day across millions of IPs. The vast majority of internet "attacks" are just noise.

3. The few smart ones are very smart

That French IP with the /dev/tcp/ trick, rotating C2 infrastructure, and UPX-packed binaries? That's professional-grade offensive tooling. The gap between the bottom 99% and the top 1% of attackers is enormous.

4. Crypto is a magnet

The volume of attempts targeting Solana node credentials (solana/sol/validator/node) was surprising. Running crypto infrastructure on a publicly-accessible SSH port without key-based auth is actively being hunted.

5. Some people are just curious

The explorer from Cameroon, the slow typer from Berlin, the person from Bangladesh poking around /var and creating text.txt — these aren't malicious actors. They're curious humans who found an open door and wanted to see what was on the other side. They didn't download malware or try to establish persistence. They just... looked around.

6. Nobody reads the MOTD

The honeypot displays a full Ubuntu welcome message with system stats when you log in. Not a single interactive user appeared to notice or care that the system information was suspiciously static. First thing they do? ls.

That's pretty interesting.

I have been running an SSH tarpit for several years. Basically it's a tiny go executable that responds to SSH connections, and then proceeds to very very slowly respond with an endless banner. So clients wait endlessly for the login prompt. I have seen clients getting stuck and waiting for whole weeks.

Link for anyone who wants to run a tarpit themselves: https://github.com/skeeto/endlessh

That was an interesting read.Thank you.

I'm out.

Hey, the comments link isn't actually a link, whoever is running this bot.

I do something even dumber https://drkt.eu/files/ramblings/honeypots-and-tarpits.html

Very much worth a read!

Not much have changed in 20 years. Was the exact same when I went to school

nice try, buddy! 🤓

None of the stuff here surprises me in general, but the specifics on sources of attacks, how much crypto shit is unsecured for it to be default approach for so many attempts, how much were bots vs actual humans, etc. is all very interesting.

Good read✅

This so much reminds me of working in the aughts and we just could not install and then update. Updates, firewalls, and other configuration had to be setup when the system was put online because they got hammered the moment they went online. It was kinda sudden. Like we could have a default installation sit on the web over a weekend and no issue and then some year we would see more and more compromised systems and eventually we just could not put something online without it being pre hardened.

Is the link fine? I'm failing to resolve

Slightly very annoyed how this reads like slop. The research is interesting but I can't keep reading this without that annoying itch you get from seeing the same pattern over and over again.

Fun read. Suprised how much of the codespeak I understood. I've run linux here or there, and I used to do some hackery decades ago. I'm no modern botnet runner, but it seems things haven't changed all too much.