General··3 min read

What Hit My Linux Honeypot in 7 Days? 108K Attack Sessions Analyzed

"From credential spraying and BusyBox probes to a coordinated, multi-architecture cryptomining deployment."

My field report based on raw authentication, command, session, and payload telemetry.

Honeypot dashboard: 108,114 sessions, 1,305 unique IPs, 178,283 failed logins, 8,341 accepted, 21,038 commands, 1,125 downloads
Figure 1: A honeypot Weekly Telemetry Data

Shape of the week

Daily session counts on the left, hourly distribution on the right (UTC). In conclusion, Automated bots do not sleep, but campaigns still have a rhythm.

Daily session trend peaking August 2 and hourly distribution showing consistent attack activity across all 24 hours
Figure 2: Daily Session Attempts & Distribution Bar Graph

Credential attempts

I intentionally put a mask on passwords. Bots replay credentials harvested elsewhere. Some of these may be real leaked passwords.

Top brute-forced credentials: enable and system passwords most attempted at 29k each; root and admin combos most accepted
Figure 3: Tried user:pass Combinations
Mirai overlap: I identified 46 of the attempted pairs match credentials from the leaked Mirai source code's 60 defaults. These pairs account for 22.2% of all login attempts (39,496 tries). Most of the traffic is not a new attack and it's copies of a decade-old codebase still circulating, each one probing for a specific camera or DVR firmware's factory password.

Commands run inside my honeypot

260 IPs reached a shell (19.9% of all sources). The rest tried credentials and left.

Command families: telnet shell spawn 10,489, unclassified 6,857, busybox probe 2,925; raw commands led by cd /proc and sh
Figure 4: Command Categories & Commands

Payloads downloaded

The honeypot stores files but never executes them (even attacker attempts, simply it is in honeypot).

I identified:

  • 15 unique files
  • 1,125 download attempts.
Downloaded malware samples with SHA-256 hashes, counts, and source URLs including twget.sh and deploy.sh scripts
Figure 5: Malicious File Download Attempt

Who were connecting

Based on retrieved data, geography and network owner from a local MaxMind database; reputation tags from public lists observed. None of this triggers any action. They were simply context ,so nothing more.

Attack source geography: Germany 61,170 and Singapore 27,373 top countries; DigitalOcean 28,850 top network owner
Figure 6: Captured Traffic, Session and their Providers
SSH client signatures: libssh Mirai-derived 646, Paramiko Python 355, OpenSSH 317, Go scanner 217
Figure 7: The Attempts made by different clients. Ex: SSH for OpenSSH client and Scanner frameworks indicating fuzzing tools on web.

642 sources (49%) already appear on at least one public blocklist. It does not mean they should be blocked a listing is information, not a verdict.

Most active attacker IPs with country, network owner, session count, commands, downloads, and IPsum reputation scores
Figure 8: Sounds Interesting, I had traffics from Turk Telekom as provider as well.

MITRE ATT&CK coverage

Every technique derives from a concrete command or login attempt recorded in my honeypot. We can categorize them as

Rule-based and deterministic: if there is no evidence, the technique is not listed. In my case, most of the trials were false positive ,but I tried to add most identical & real ones.

MITRE ATT&CK heatmap: Initial Access through Credential Access phases, Password Guessing T1110.001 highest at 178,305 events
Figure 9: MITRE Attack Mapping
MITRE ATT&CK heatmap continued: Discovery through Impact, Ingress Tool Transfer 1,442 and Service Stop 437 events
Figure 10: MITRE Attack Mapping 2
ATT&CK technique table: all 14 observed techniques with IDs, names, tactic categories, event counts, and unique source IPs

Unobserved tactics (4)

  • Reconnaissance,
  • Resource Development,
  • Collection,
  • Exfiltration.

It was not a detection gap because my honeypot holds nothing worth stealing, so collection and exfiltration never begin. Reconnaissance and resource development happen on the attacker's side, without touching me. From my point of view, the gap shows that thanks to Honeypot, how far an attack can progress inside the honeypot before hitting a dead end.