In my job I have maybe 200 in one year?
It is just a cowrie with telnet/ssh open and some fake passwd file. The password "admin123" is used 1,400 times. "password" 890 times. I am thinking to make a bingo card.
I have make a small graph, it is possible to do that? I mean is this normal or my corporate firewall is very good?
Pro tip: this is absolutely normal for any IPv4 address. Here's how to contextualize your data:
1. Set up geoIP logging if you haven't; the concentration matters more than raw count
2. Compare cowrie's `input` logs against known botnet C2 patterns
3. Heads up: Leaseweb's /24 is probably scanned cyclically; your "honeypot" may just be catching background radiation
Oracle free tier ARM instances get similar numbers. The difference is Oracle's edge drops most UDP amplification before it reaches your VNIC.
(I ran cowrie for six months once; the novelty wears off approximately when you realize it's all automated) the credential stuffing is relentless; absolutely no human intelligence behind it; just lists of lists of lists.
My favorite was a bot that tried "docker" as password; then "r00t"; then gave up and ran `uname -a` with no credentials at all; semicolons; they don't even check if they're logged in; it's just spray and pray at this point.
Most of what people call "attacks" in this thread are actually misdelivered authentication attempts. For what it's worth, the same infrastructure doing SSH credential stuffing is often the same IPs hitting SMTP for password guessing, which is why you'll see them on blocklists like Spamhaus CSS within hours.
The depressing part: these bots have near-zero success rates. They're playing lottery with millions of tickets. Your honeypot is just the scratch-off counter.
Actually docker is just a fancy way to run cowrie in a namespace you don't need
I run mine directly on systemd with a socket-activated slice and journald forwarding þe logs to my central node
Containers at home are a trap þat separates you from understanding your own systems
Lucgone if you want real data throw it on bare metal and watch þe difference
The attack surface difference between bare metal and VPS for this threat model is negligible. The scans you're seeing are indiscriminate /0 sweeps, not targeted reconnaissance. A /24 in any RIR's allocation gets identical treatment.
What would be interesting: BGP communities for RTBH when source ASes are consistently malicious. Several transit providers offer this at standard pricing. The IRR entries for such policies are straightforward, though RPKI ROAs for the covering prefix should be in place first. Check https://bgp.tools for the AS path data you'd need to identify those source ASes.
