honeypotlive
Security and privacy
ssh honeypot dashboard
SHOW HN2026
181points
63comments
#333of 4,366 in 2026
Top 8%of 2026 by points
How HN took it
MixedNo clear lean
7 positive, 6 neutral or asking, 1 mixed, 4 critical, out of 18 comments about the project. Thread score +0.19.
Idea: 4 for, 0 againstExecution: 0 for, 2 againstDesign: 1 for, 1 againstPrivacy: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Useful, educational look at honeypot traffic
From 3 comments
Watching the first few minutes was more educational than I expected.
preetham_rangu on HNThis is great. Thanks. Try fingerprinting the behaviour in the sessions. Over time you should be able to distinguish between various automated tools and live people.
krunck on HNHi, this is very interesting, thanks. While trying to educate myself about honeypots I came across this (https://securehoney.net/). The aggregations of popular logins and IP…
p1anecrazy on HN
Interesting fun project
From 3 comments
Its always wild seeing the sheer volume of background noice on public IPs. Fun project.
Farrynet on HNCool
jsabess24 on HNLooks cool!
CzaxTanmay on HN
Objections
Public IPs and credentials may expose compromised machines and private data
From 2 comments
Some kind of source IP masking would be prudent. As you pointed out, some of those machines are compromised, and you aren't making their owners' lives any easier. Bad actors…
rkagerer on HNFor the sake of interest you could try to expose periodically rotated keyed hashes of IPs and credentials instead of the raw values. It would still let people correlate events…
spikk on HN
Site was spammed with junk input, making it hard to see real patterns
From 2 comments
Opened the website to be greeted with only spam of huge walls of random text, seems people are abusing the fun out of it! Would love to actually have seen some interesting bot…
Fabricio20 on HNfun to watch until the ssh user input exploits the web interface :P
_def on HN
Requests
Add geolocation or ASN data for source IPs
From 3 comments
Very cool! Adding a client geo would be nice (even if its not very accurate)
throwaway7783 on HNYou know what extra data would be cool? If you hit `curl https://ip.guide/{src_ip}` and got back the ASN and country etc and added a leaderboard. In my own experiments in this…
drcongo on HNCowrie author here! Yes this is the usual background noise on the internet! Cowrie (which I suspect is used here as well as the data generator) recently had a lot of updates,…
micheloosterhof on HN
Fingerprint behaviour to separate bots from humans
From 1 comment
This is great. Thanks. Try fingerprinting the behaviour in the sessions. Over time you should be able to distinguish between various automated tools and live people.
krunck on HN
Mask or hash source IPs and credentials
From 2 comments
Some kind of source IP masking would be prudent. As you pointed out, some of those machines are compromised, and you aren't making their owners' lives any easier. Bad actors…
rkagerer on HNFor the sake of interest you could try to expose periodically rotated keyed hashes of IPs and credentials instead of the raw values. It would still let people correlate events…
spikk on HN
Questions
What do the bots do after login and which patterns recur
From 2 comments
Opened the website to be greeted with only spam of huge walls of random text, seems people are abusing the fun out of it! Would love to actually have seen some interesting bot…
Fabricio20 on HNWatching the first few minutes was more educational than I expected.
preetham_rangu on HN
Alternatives named
Cowrie
From 2 comments
Cowrie author here! Yes this is the usual background noise on the internet! Cowrie (which I suspect is used here as well as the data generator) recently had a lot of updates,…
micheloosterhof on HNHi HN, I maintain several web servers and kept seeing a constant stream of SSH login attempts. At some point I became curious: what do these bots actually try to do after they…
tusksm on HN
securehoney.net
From 1 comment
Hi, this is very interesting, thanks. While trying to educate myself about honeypots I came across this (https://securehoney.net/). The aggregations of popular logins and IP…
p1anecrazy on HN
honeyprompt
From 1 comment
Hi tusksm! It's honeypot season! Really cool project, I've been working on a honeypot project of my own right now called `honeyprompt`…
arm32 on HN