Get information about news, new releases, new themes or new plugins on our social networks Facebook, Twitter and YouTube or visit our Blog.

Your About page is typically one of the most visited pages on your site, need to be simple with a few key things, such as your name, who are you, how can contact you, a small story, etc.

1 connections hit the honeypot on 2026-08-18, from 1 unique IP(s).

Top source IPs

54.66.147.65 — 1 connections

Commands attempted

ssh test@54.66.147.65

exit

Auto-generated from the Cowrie session logs.

This day has ended — the numbers above are final and will not change further.

A walkthrough of turning a fresh EC2 instance into an SSH honeypot with Cowrie, without losing real SSH access in the process.

Step 1: Move real SSH off port 22

Real sshd has to leave port 22 before anything else, so Cowrie can take it over later.

sudo sed -i '/^#Port 22$/a Port 22\nPort 2222' /etc/ssh/sshd_config
sudo systemctl restart sshd

Tested the new port from a second terminal before touching anything else, then dropped the old one:

sudo sed -i '/^Port 22$/d' /etc/ssh/sshd_config
sudo systemctl restart sshd

Step 2: Dedicated user for Cowrie

sudo useradd -m -s /bin/bash cowrie
sudo passwd -l cowrie

Step 3: Install Cowrie

sudo dnf install -y git python3.11 python3-pip python3-devel openssl-devel libffi-devel gcc gcc-c++ make
sudo su - cowrie
git clone https://github.com/cowrie/cowrie
cd cowrie
python3.11 -m venv cowrie-env
source cowrie-env/bin/activate
pip install -r requirements.txt
pip install -e .
cp src/cowrie/data/etc/cowrie.cfg.dist etc/cowrie.cfg

Cowrie's default SSH port (2222) collided with the real sshd sitting on the same port now, so it got moved to 2223:

sed -i 's/listen_endpoints = tcp:2222:interface=0.0.0.0/listen_endpoints = tcp:2223:interface=0.0.0.0/' etc/cowrie.cfg
cowrie start

Step 4: Redirect port 22 into the honeypot

sudo iptables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-port 2223

Anyone hitting port 22 from the internet now lands in Cowrie's fake shell instead of a real login prompt.

Step 5: Automate reporting

A small Python script reads cowrie.json, tallies the day's connections and top source IPs, and writes both a live stats file and a new blog post whenever there's activity. It runs via cron every 15 minutes so this blog updates itself.

First bot showed up within hours of opening port 22.