Originalresearch
Original data from this site's own infrastructure. A public SSH honeypot in Helsinki, and what automated attackers really do when no one is watching.
Reports built from raw honeypot logs - over a million events, real implants, real source IPs. Every number re-derived from the logs, not repeated from a vendor.
The track log
what's on fileField reports
4 in this track // newest firstSomebody Read the Site, Then Came Back Every Week: A Month of Targeted Credential Attacks Against This Server's Own Usernames
Two usernames exist in this honeypot's logs that appear in no credential wordlist: syscfg and feed, the site's handle…
Open report →One Key, 511 Hosts: How a Shared SSH Public Key Fingerprints a Botnet That IP Blocklists Cannot See
A single RSA public key was implanted 632 times from 511 distinct source IPs across 30 days of honeypot logs. The…
Open report →Testing a Four-Year-Old Botnet Fingerprint: The mdrfckr Campaign's Published HASSH Is Dead and Its Payload Never Changed
A HASSH fingerprint published in 2022 for the mdrfckr SSH botnet matched zero of 632 implants in a 2026 honeypot…
Open report →31 Days Inside a Public SSH Honeypot: 1.25 Million Events, Multi-Architecture Malware, and What Automated Attackers Actually Do
A Cowrie SSH honeypot on a Helsinki VPS logged 1,251,496 events across 134,060 sessions in 31 days. Analysis of the…
Open report →Track console
shell // guest sessionTry help, random, latest, grep <term>, or count.