[{"data":1,"prerenderedAt":396},["ShallowReactive",2],{"project-48947548":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":35,"aspects":36,"strip":43,"post_text":46,"what":47,"said":78,"maker_in_thread":182,"shape":188,"grid":191,"attempts":357,"same_week":358,"maker_shows":33,"maker_hidden":388,"reader_version":389,"card":390},"48947548","honeypotlive","Watch bots interact with an SSH honeypot in real time","title","Show HN: Watch bots interact with an SSH honeypot in real time","https:\u002F\u002Fhoneypotlive.cc\u002F","honeypotlive.cc","tusksm",1784297115,2026,181,63,333,4366,8,"notable","security_privacy","ssh honeypot dashboard","web_app",[24,25,26,27],"ssh honeypot","cowrie","bot traffic","threat intelligence","mixed",0.189,{"positive":31,"neutral":32,"mixed":33,"critical":34},7,6,1,4,18,{"idea":37,"execution":39,"privacy":41,"design":42},{"positive":34,"critical":38},0,{"positive":38,"critical":40},2,{"positive":38,"critical":33},{"positive":33,"critical":33},[44,44,38,38,38,38,45,44,38,44,38,44,38,38,44,33,45,45,33,45,38,38,38,38,44,44,38,38,38,38,38,38,38,38,38,38,38,38,38,38],3,5,null,{"problem":48,"audience":46,"pricing":46,"motivation":55,"time_to_build":46,"stack":59,"openness":76,"stage":77,"team_size":76},{"value":49,"source":50,"evidence":51},"Shows what SSH login bots do after they get in, and reveals recurring campaign behavior.","maker",[52],{"id":53,"by":11,"text":54},"48947557","Hi HN, I maintain several web servers and kept seeing a constant stream of SSH login attempts. At some point I became curious: what do these bots actually try to do after they…",{"value":56,"source":50,"evidence":57},"Curiosity about what SSH bots do after they get in, while maintaining web servers.",[58],{"id":53,"by":11,"text":54},[60,64,68,72],{"value":61,"source":50,"evidence":62},"Cowrie SSH honeypot",[63],{"id":53,"by":11,"text":54},{"value":65,"source":50,"evidence":66},"Python",[67],{"id":53,"by":11,"text":54},{"value":69,"source":50,"evidence":70},"WebSockets",[71],{"id":53,"by":11,"text":54},{"value":73,"source":50,"evidence":74},"Nginx",[75],{"id":53,"by":11,"text":54},"unknown","launched",{"praise":79,"objections":111,"requests":134,"questions":159,"alternatives":165},[80,96],{"value":81,"source":82,"evidence":83},"Useful, educational look at honeypot traffic","commenter",[84,88,92],{"id":85,"by":86,"text":87},"48948993","preetham_rangu","Watching the first few minutes was more educational than I expected.",{"id":89,"by":90,"text":91},"48948312","krunck","This is great. Thanks. Try fingerprinting the behaviour in the sessions. Over time you should be able to distinguish between various automated tools and live people.",{"id":93,"by":94,"text":95},"48948260","p1anecrazy","Hi, this is very interesting, thanks. While trying to educate myself about honeypots I came across this (https:\u002F\u002Fsecurehoney.net\u002F). The aggregations of popular logins and IP…",{"value":97,"source":82,"evidence":98},"Interesting fun project",[99,103,107],{"id":100,"by":101,"text":102},"48950043","Farrynet","Its always wild seeing the sheer volume of background noice on public IPs. Fun project.",{"id":104,"by":105,"text":106},"48978180","jsabess24","Cool",{"id":108,"by":109,"text":110},"48948505","CzaxTanmay","Looks cool!",[112,123],{"value":113,"source":82,"evidence":114},"Public IPs and credentials may expose compromised machines and private data",[115,119],{"id":116,"by":117,"text":118},"48948531","rkagerer","Some kind of source IP masking would be prudent. As you pointed out, some of those machines are compromised, and you aren't making their owners' lives any easier. Bad actors…",{"id":120,"by":121,"text":122},"48949975","spikk","For the sake of interest you could try to expose periodically rotated keyed hashes of IPs and credentials instead of the raw values. It would still let people correlate events…",{"value":124,"source":82,"evidence":125},"Site was spammed with junk input, making it hard to see real patterns",[126,130],{"id":127,"by":128,"text":129},"48952349","Fabricio20","Opened the website to be greeted with only spam of huge walls of random text, seems people are abusing the fun out of it! Would love to actually have seen some interesting bot…",{"id":131,"by":132,"text":133},"48950769","_def","fun to watch until the ssh user input exploits the web interface :P",[135,150,154],{"value":136,"source":82,"evidence":137},"Add geolocation or ASN data for source IPs",[138,142,146],{"id":139,"by":140,"text":141},"48951262","throwaway7783","Very cool! Adding a client geo would be nice (even if its not very accurate)",{"id":143,"by":144,"text":145},"48948547","drcongo","You know what extra data would be cool? If you hit `curl https:\u002F\u002Fip.guide\u002F{src_ip}` and got back the ASN and country etc and added a leaderboard. In my own experiments in this…",{"id":147,"by":148,"text":149},"48954652","micheloosterhof","Cowrie author here! Yes this is the usual background noise on the internet! Cowrie (which I suspect is used here as well as the data generator) recently had a lot of updates,…",{"value":151,"source":82,"evidence":152},"Fingerprint behaviour to separate bots from humans",[153],{"id":89,"by":90,"text":91},{"value":155,"source":82,"evidence":156},"Mask or hash source IPs and credentials",[157,158],{"id":116,"by":117,"text":118},{"id":120,"by":121,"text":122},[160],{"value":161,"source":82,"evidence":162},"What do the bots do after login and which patterns recur",[163,164],{"id":127,"by":128,"text":129},{"id":85,"by":86,"text":87},[166,171,175],{"value":167,"source":82,"evidence":168},"Cowrie",[169,170],{"id":147,"by":148,"text":149},{"id":53,"by":11,"text":54},{"value":172,"source":82,"evidence":173},"securehoney.net",[174],{"id":93,"by":94,"text":95},{"value":176,"source":82,"evidence":177},"honeyprompt",[178],{"id":179,"by":180,"text":181},"48948105","arm32","Hi tusksm! It's honeypot season! Really cool project, I've been working on a honeypot project of my own right now called `honeyprompt`…",{"comments":40,"answered":38,"key":183},[184,185],{"id":53,"text":54},{"id":186,"text":187},"48990511","Added https:\u002F\u002Fhoneypotlive.cc\u002Fcampaigns\u002F to view combined campaigns. For now, only in strict high-confidence clusters.",{"commenters":189,"max_depth":31,"maker_replies":40,"first_comment_mins":33,"lifespan_hours":190},51,93,[192,194,195,199,202,206,208,211,213,216,218,221,223,226,227,229,231,234,238,241,243,246,248,251,255,257,260,263,267,270,274,278,280,282,283,286,289,290,293,294,296,299,302,305,308,311,314,317,320,322,324,327,330,332,335,337,340,343,346,349,351,354],[147,38,44,193,148,38],"project\u002Fneutral\u002Fidea",[143,33,44,193,144,38],[196,33,38,197,198,38],"48949203","other\u002Fneutral\u002Fnone","reaperducer",[200,33,38,197,201,38],"48949243","ok123456",[203,33,38,204,205,38],"48988548","commenter\u002Fneutral\u002Fnone","razodactyl",[207,33,38,204,144,38],"48950084",[209,33,38,197,210,38],"48955316","exiguus",[212,33,38,204,144,38],"48966681",[214,33,38,204,215,38],"48955985","yjftsjthsd-h",[179,40,45,217,180,38],"project\u002Fpositive\u002Fidea",[219,44,38,197,220,38],"48948915","belval",[131,34,44,222,132,38],"project\u002Fmixed\u002Fexecution",[224,34,38,204,225,38],"48951653","fragmede",[100,45,45,217,101,38],[127,32,33,228,128,38],"project\u002Fcritical\u002Fexecution",[230,31,38,197,225,38],"48952130",[232,31,38,197,233,38],"48952213","Human-Cabbage",[235,31,44,236,237,38],"48953540","maker\u002Fneutral\u002Fidea","inigyou",[239,31,38,204,240,38],"48960144","voakbasda",[242,31,38,204,237,38],"48969384",[244,18,38,197,245,38],"48948328","tarpitt",[139,247,44,193,140,38],9,[120,249,44,250,121,38],10,"project\u002Fneutral\u002Fprivacy",[252,253,33,228,254,38],"48954323",11,"charcircuit",[85,256,45,217,86,38],12,[104,258,45,259,105,38],13,"project\u002Fpositive\u002Fnone",[108,261,45,262,109,38],14,"project\u002Fpositive\u002Fdesign",[264,261,33,265,266,38],"48949000","project\u002Fcritical\u002Fdesign","Diti",[268,261,38,204,269,38],"48949090","__MatrixMan__",[271,272,45,259,273,38],"48954827",15,"asd000hh",[275,276,38,197,277,38],"48949015",16,"b0rbb",[279,276,38,197,225,38],"48952142",[53,281,38,193,11,33],17,[93,281,38,197,94,38],[284,281,38,197,285,38],"48948394","LorenDB",[287,281,38,204,288,38],"48948805","CookieCrisp",[186,281,38,193,11,33],[291,281,44,193,292,38],"48948271","hideout_berlin",[89,281,45,217,90,38],[116,281,33,295,117,38],"project\u002Fcritical\u002Fprivacy",[297,281,38,204,298,38],"48948734","ryandrake",[300,281,38,204,301,38],"48948942","taftster",[303,281,38,204,304,38],"48951395","singleshot_",[306,281,38,204,307,38],"48949471","dpoloncsak",[309,281,38,197,310,38],"48949781","rolph",[312,281,38,197,313,38],"48955722","left-struck",[315,35,38,197,316,38],"48949039","paoliniluis",[318,35,38,197,319,38],"48949135","KomoD",[321,35,38,204,198,38],"48949186",[323,35,38,204,319,38],"48949236",[325,35,38,204,326,38],"48949409","gruez",[328,35,38,204,329,38],"48949462","GreenVulpine",[331,35,38,204,319,38],"48951174",[333,35,38,204,334,38],"48949826","toilet",[336,35,38,204,319,38],"48951181",[338,35,38,204,339,38],"48951679","bleepblap",[341,35,38,204,342,38],"48949475","m00dy",[344,35,38,204,345,38],"48949804","efilife",[347,35,38,204,348,38],"48950248","athrowaway3z",[350,35,38,204,319,38],"48951102",[352,35,38,197,353,38],"48950437","alin23",[355,35,38,197,356,38],"48950247","williamcotton",[],[359,364,369,373,378,383],{"id":360,"name":361,"points":362,"category":363},"48968606","I replaced a $120k bowling center system with $1,600 in ESP32s",2935,"hardware",{"id":365,"name":366,"points":367,"category":368},"49008211","Bento",1033,"creative",{"id":370,"name":371,"points":372,"category":368},"48984254","Grace Cathedral Gaussian Splat tour",263,{"id":374,"name":375,"points":376,"category":377},"49008406","HN Hall of Fame",219,"consumer_social",{"id":379,"name":380,"points":381,"category":382},"48946738","Justif",198,"languages",{"id":384,"name":385,"points":386,"category":387},"49010782","Cactus Hybrid",191,"ai",false,"v2",{"id":391,"name":5,"line":6,"ai":388,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":392,"top":18,"kw":393,"maker":11,"domain":10,"tier":19,"attempts":38,"strip":394,"url":9,"mix":395,"praise":81,"objection":113,"sub":21},48947548,0.19,[24,25,26,27],"3300005303030031551500003300000000000000",[31,32,33,34],1794036705323]