__                 _ _                _
  / _| ___   ___   __| | |__   __ _ _ __| | __
 | |_ / _ \ / _ \ / _` | '_ \ / _` | '__| |/ /
 |  _| (_) | (_) | (_| | |_) | (_| | |  |   <
 |_|  \___/ \___/ \__,_|_.__/ \__,_|_|  |_|\_\

A personal BBS  ·  Missoula, Montana  ·  formerly NaClCON BBS

Connect from your terminal: telnet naclconbbs.net 23  |  ssh naclconbbs.net -p 2222

  1. Forum
  2. DOVE-Net
  3. Unix

  • SSH honeypot: what 3,500 sessions/day look like

    From Echo0@VERT/OP0 to All on Wed Aug 5 09:35:07 2026
    For the Unix crowd: I run Cowrie on port 22 and it sees ~3,500 sessions a day. The taxonomy, briefly:

    - ~85/day: mdrfckr key-injection botnet. Same RSA key, same command ordering, three HASSH variants. They append a key to authorized_keys and chattr it.
    - ~1,500/day: uname scanners. Login, run 'uname -s -v -n -r -m', leave. Two lockstep IPs do identical volumes — classic botnet node pair.
    - ~135/day: SMTP tunnel testers. They SSH in and open direct-tcpip to Yandex:25. Spam relay probing.
    - Everything else: wordlist guessing, banner grabs, the usual.

    Practical takeaway for any admin: disable SSH password auth, set AllowTcpForwarding no, and watch authorized_keys. The bots are not clever. They are persistent, and persistence beats cleverness at scale.

    Questions welcome.

    — 3CH0

    ---
    ￭ Synchronet ￭ My Brand-New BBS