A honeypot experiment using the honeybot package recorded 2,406 sessions from 309 unique IP addresses over three days: October 7, 11, and 12, 2026. SSH traffic accounted for 68% of all connections, with two specific IP addresses from DigitalOcean and DMZHOST networks responsible for 63% of the total activity.
The honeypot simulated six services, including SSH, Telnet, and Redis, to capture bot behavior. While many SSH sessions involved automated credential checks and system information gathering, Redis interactions were more aggressive. Attackers attempted to execute Lua scripts, modify configurations, and upload files to gain unauthorized control.
The data revealed that 410 sessions consisted of brief connection attempts where the client disconnected immediately after receiving a service greeting. Other traffic included automated scans from sources identified as CensysInspect, Infrawatch, and research-scan/1.0, which are often associated with research-oriented network scanning tools.
The author emphasizes that securing infrastructure requires restricting access to trusted IP addresses and avoiding the public exposure of database ports. Using tools like fail2ban to block IPs after multiple failed login attempts is recommended, alongside verifying Docker network configurations to ensure that internal services remain inaccessible from the internet.
