Xin chào, mình là Kris Pham 👋

1 connections hit the honeypot on 2026-08-18, from 1 unique IP(s).

Top source IPs

54.66.147.65 — 1 connections

Commands attempted

ssh test@54.66.147.65

exit

Auto-generated from the Cowrie session logs.

---

This day has ended — the numbers above are final and will not change further.

68 connections hit the honeypot on 2026-08-20, from 44 unique IP(s).

Top source IPs

111.207.227.228 — 6 connections
46.33.121.4 — 2 connections
73.177.188.238 — 2 connections
179.36.233.188 — 2 connections
193.57.42.42 — 2 connections

Commands attempted

/ip cloud print
ifconfig
uname -a
cat /proc/cpuinfo
ps | grep '[Mm]iner'
ps -ef | grep '[Mm]iner'
ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
locate D877F783D5D3EF8Cs
echo Hi | cat -n

Auto-generated from the Cowrie session logs. Updates automatically while the day is still in progress.

---

This day has ended — the numbers above are final and will not change further.

Next goal: stop serving this off a bare IP and get it behind a real domain with real HTTPS.

Free domain

Used DuckDNS for a free subdomain. First attempt at pointing it went into the wrong field entirely — DuckDNS splits IPv4 and IPv6 into separate boxes, and the server's IP ended up typed into the IPv6 one by mistake. Fixed by moving it to the right field.

Elastic IP first

Before pointing a domain at anything, allocated an Elastic IP and associated it with the instance, so the address wouldn't shift on a stop/start. Associating it changed the public IP immediately — and broke the site's styling, because Bludit had the old IP baked into its site config as the base URL. Every CSS and JS request was still trying to load from an address that no longer pointed here.

sudo sed -i 's/OLD_IP/NEW_IP/g' bl-content/databases/site.php

Certbot

Amazon Linux doesn't ship certbot in its repos, so it went in through a Python venv instead:

sudo dnf install -y python3 augeas-libs
sudo python3 -m venv /opt/certbot/
sudo /opt/certbot/bin/pip install --upgrade pip
sudo /opt/certbot/bin/pip install certbot certbot-nginx
sudo ln -s /opt/certbot/bin/certbot /usr/bin/certbot

First run failed — certbot couldn't find a matching nginx server block, because nginx.conf still had server_name _;, a wildcard that doesn't match a real domain name. Swapped it for the actual domain, reloaded nginx, then re-ran the install step and the cert deployed cleanly.

The mixed-content trap, again

Switching to https:// broke styling a second time, same root cause as the IP change: the site's base URL was still saved as http://, so the browser blocked every asset as insecure mixed content. One more sed against site.php, this time swapping the scheme, fixed it for good.

What I actually learned

Whatever stores your site's base URL will bite you twice — once when the IP changes, once when the scheme does. Elastic IP before DNS, DNS before certs, in that order, saves a redo. And server_name _; is a real value, not a placeholder — certbot takes it literally.

A reference dump of every command from the honeypot and domain/HTTPS posts — no narrative, just the commands, grouped by post.

From: Building my first honeypot on AWS

sudo sed -i '/^#Port 22$/a Port 22\nPort 2222' /etc/ssh/sshd_config
sudo systemctl restart sshd
sudo sed -i '/^Port 22$/d' /etc/ssh/sshd_config
sudo systemctl restart sshd
sudo useradd -m -s /bin/bash cowrie
sudo passwd -l cowrie
sudo dnf install -y git python3.11 python3-pip python3-devel openssl-devel libffi-devel gcc gcc-c++ make
sudo su - cowrie
git clone https://github.com/cowrie/cowrie
cd cowrie
python3.11 -m venv cowrie-env
source cowrie-env/bin/activate
pip install -r requirements.txt
pip install -e .
cp src/cowrie/data/etc/cowrie.cfg.dist etc/cowrie.cfg
sed -i 's/listen_endpoints = tcp:2222:interface=0.0.0.0/listen_endpoints = tcp:2223:interface=0.0.0.0/' etc/cowrie.cfg
cowrie start
sudo iptables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-port 2223

From: Getting a real domain and real HTTPS

sudo sed -i 's/OLD_IP/NEW_IP/g' bl-content/databases/site.php
sudo dnf install -y python3 augeas-libs
sudo python3 -m venv /opt/certbot/
sudo /opt/certbot/bin/pip install --upgrade pip
sudo /opt/certbot/bin/pip install certbot certbot-nginx
sudo ln -s /opt/certbot/bin/certbot /usr/bin/certbot
sudo certbot --nginx -d DOMAIN
sudo certbot install --cert-name DOMAIN
sudo sed -i 's/http:\/\/DOMAIN/https:\/\/DOMAIN/g' bl-content/databases/site.php

Automating the blog

sudo dnf install -y cronie
sudo systemctl enable --now crond
echo '*/15 * * * * root /usr/bin/python3 /usr/local/bin/honeypot_blog.py >> /var/log/honeypot_blog.log 2>&1' | sudo tee /etc/cron.d/honeypot-blog

219 connections hit the honeypot on 2026-08-19, from 59 unique IP(s).

Top source IPs

91.92.47.123 — 98 connections
27.79.3.95 — 11 connections
36.94.140.29 — 11 connections
116.110.152.194 — 6 connections
3.232.93.173 — 6 connections

Commands attempted

uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m
uname -s -v -n -r -m

Auto-generated from the Cowrie session logs. Updates automatically while the day is still in progress.

---

This day has ended — the numbers above are final and will not change further.

A walkthrough of turning a fresh EC2 instance into an SSH honeypot with Cowrie, without losing real SSH access in the process.

Step 1: Move real SSH off port 22

Real sshd has to leave port 22 before anything else, so Cowrie can take it over later.

sudo sed -i '/^#Port 22$/a Port 22\nPort 2222' /etc/ssh/sshd_config
sudo systemctl restart sshd

Tested the new port from a second terminal before touching anything else, then dropped the old one:

sudo sed -i '/^Port 22$/d' /etc/ssh/sshd_config
sudo systemctl restart sshd

Step 2: Dedicated user for Cowrie

sudo useradd -m -s /bin/bash cowrie
sudo passwd -l cowrie

Step 3: Install Cowrie

sudo dnf install -y git python3.11 python3-pip python3-devel openssl-devel libffi-devel gcc gcc-c++ make
sudo su - cowrie
git clone https://github.com/cowrie/cowrie
cd cowrie
python3.11 -m venv cowrie-env
source cowrie-env/bin/activate
pip install -r requirements.txt
pip install -e .
cp src/cowrie/data/etc/cowrie.cfg.dist etc/cowrie.cfg

Cowrie's default SSH port (2222) collided with the real sshd sitting on the same port now, so it got moved to 2223:

sed -i 's/listen_endpoints = tcp:2222:interface=0.0.0.0/listen_endpoints = tcp:2223:interface=0.0.0.0/' etc/cowrie.cfg
cowrie start

Step 4: Redirect port 22 into the honeypot

sudo iptables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-port 2223

Anyone hitting port 22 from the internet now lands in Cowrie's fake shell instead of a real login prompt.

Step 5: Automate reporting

A small Python script reads cowrie.json, tallies the day's connections and top source IPs, and writes both a live stats file and a new blog post whenever there's activity. It runs via cron every 15 minutes so this blog updates itself.

First bot showed up within hours of opening port 22.

Hướng dẫn từng bước dựng honeypot SSH bằng Cowrie trên Amazon Linux 2023 — tách riêng khỏi phần lỗi vặt, chỉ tập trung vào quy trình đúng. Toàn bộ lệnh dưới đây đã chạy thật trên server này.

Bước 1: Tạo user riêng cho Cowrie

Không chạy Cowrie bằng root hay ec2-user — tạo một user riêng, khoá luôn đăng nhập bằng mật khẩu vì user này không cần đăng nhập trực tiếp bao giờ.

sudo useradd -m -s /bin/bash cowrie
sudo passwd -l cowrie

Bước 2: Cài Python 3.11

Cowrie bản mới yêu cầu Python ≥3.10, trong khi Amazon Linux 2023 chỉ có sẵn 3.9.

sudo dnf install -y python3.11

Bước 3: Tải và cài Cowrie

sudo su - cowrie
git clone https://github.com/cowrie/cowrie
cd cowrie
python3.11 -m venv cowrie-env
source cowrie-env/bin/activate
pip install --upgrade pip
pip install -r requirements.txt
pip install -e .

Bản Cowrie mới đăng ký lệnh cowrie qua pip thay vì dùng script bin/cowrie như trước — sau bước pip install -e . là gọi thẳng được cowrie start/cowrie stop.

Bước 4: Đổi port nội bộ, tránh đụng SSH thật

Port mặc định của Cowrie là 2222 — trùng với port SSH quản trị thật đã đổi trước đó. Sửa file cấu hình:

cp etc/cowrie.cfg.dist etc/cowrie.cfg

Tìm dòng listen_endpoints trong etc/cowrie.cfg, đổi thành:

listen_endpoints = tcp:2223:interface=0.0.0.0

Bước 5: Chuyển hướng port 22 công khai vào Cowrie

Cowrie chỉ lắng nghe ở port nội bộ 2223 — dùng iptables để mọi kết nối tới port 22 công khai (nơi kẻ quét mạng sẽ gõ cửa) tự động chuyển vào honeypot.

sudo dnf install -y iptables
sudo iptables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-port 2223

Bước 6: Biến thành systemd service

Cả Cowrie lẫn rule iptables mặc định chỉ chạy tạm — restart server là mất hết. Tạo 2 service file để tự khởi động lại cùng hệ thống.

/etc/systemd/system/cowrie.service:

[Unit]
Description=Cowrie SSH/telnet Honeypot
After=network.target

[Service]
Type=forking
User=cowrie
Group=cowrie
WorkingDirectory=/home/cowrie/cowrie
Environment="PATH=/home/cowrie/cowrie/cowrie-env/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
ExecStart=/home/cowrie/cowrie/cowrie-env/bin/cowrie start
ExecStop=/home/cowrie/cowrie/cowrie-env/bin/cowrie stop
PIDFile=/home/cowrie/cowrie/var/run/cowrie.pid
Restart=on-failure

[Install]
WantedBy=multi-user.target

/etc/systemd/system/cowrie-redirect.service:

[Unit]
Description=Redirect port 22 into Cowrie honeypot
After=network.target

[Service]
Type=oneshot
ExecStart=/usr/sbin/iptables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-port 2223
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target

Kích hoạt cả hai:

sudo systemctl daemon-reload
sudo systemctl enable --now cowrie
sudo systemctl enable --now cowrie-redirect

Bước 7: Kiểm tra honeypot hoạt động đúng

Từ một máy khác (không phải server), thử SSH vào IP công khai với mật khẩu bất kỳ:

ssh test@<IP-cong-khai-cua-server>

Cowrie sẽ chấp nhận gần như mọi mật khẩu, đưa vào một shell giả lập hệ thống Debian cũ (kernel 2.6.26) — đủ giống thật để giữ chân kẻ tấn công gõ lệnh, trong khi mọi thao tác đều bị ghi log lại đầy đủ ở /home/cowrie/cowrie/var/log/cowrie/cowrie.json.

Sau bước này, mọi kết nối vào port 22 công khai đều là honeypot — SSH quản trị thật đã nằm ở một port khác, chỉ mở cho đúng IP của chủ.