Show HN: Watch bots interact with an SSH honeypot in real time

Post by inigyou » Sun, Jul 19, 2026, 4:13 PM UTC

voakbasda wrote: post #69

inigyou wrote: post #54

Earlier quoted context omitted.

Do you allow them entry, present a fake prompt, and record what they do? Some time ago I did a little experiment by running `nc -l -p 23` (telnet) which connects the next incoming telnet connection to your console. Type in a simulated prompt like Password: or # and it'll be buffered until the connection comes in. Then see what the scanner sends.

Danger. I believe this opens a RCE hole if the attacker sends a properly crafted sequence of terminal escape codes.

Post by razodactyl » Tue, Jul 21, 2026, 5:53 AM UTC

ok123456 wrote: post #26

reaperducer wrote: post #24

Earlier quoted context omitted.

In my own experiments in this area I've been gobsmacked by how much malicious traffic comes from Azure. I'm currently fighting this battle. As of this morning: 80% of malicious traffic comes from Azure. 10% from Digital Ocean. 5% from AWS. 5% from GCP.

Closer to 95% if you count Teams.

Post by FelixKunzJr » Tue, Jul 21, 2026, 12:21 PM UTC