For five days a decoy computer sat on the public internet, dressed up as a vulnerable server. It recorded 1,419,178 events. Nearly all of that was machines talking to machines, and none of it reached a real computer.
That is the job. A decoy takes the attention, records everything, and gives up nothing.
A honeypot is a fake computer built to be attacked.
It looks genuine. There is a login screen, a file share, a website. Nothing behind any of it is real. Nobody is supposed to connect, so every connection is somebody who went looking for a way in.
Think of a shop where the shelves are empty and the staff are all cameras. There is no money in the till. Every person who tries the door gets filmed, and after a week you know exactly what the neighbourhood is like.
This is the part that matters. The numbers get very small, very fast.
Over 5.1 days the decoy logged about 3.2 events every second. Only 63,492 of those involved somebody reaching a working service rather than just knocking at the door. That is 4%. Each row is its own small picture. The squares split that row's total evenly, and the orange one marks the share that got through. Every step gets its own scale, so nothing is too small to see.
About 38% of the traffic came from companies whose business is scanning the internet. Security research firms, mostly, plus search engines that index connected devices. Most of the rest came from rented servers, many of them already compromised and running cheap automated tools.
A person at a keyboard is a rare event in this dataset.
Where the traffic came from
Attacks per day
The first and last days are only partly covered. The decoy was switched on late on 27 October and off early on 1 November, so those bars are shorter for that reason rather than because activity dropped.
The same handful of front doors, over and over. These are the services that cause the most damage when they are left exposed, which is why they are the ones being tried.
These counts include every knock at the door, not only the connections that got through, so they run far larger than the numbers in the funnel above.
Addresses from 40 countries turn up in the data. The United States leads the count, and the reason is dull: the biggest commercial scanning firms are based there. Nothing in the pattern points at you. This is the background noise that every public machine receives.
Most of this is noise. These three were working at something.
One address opened 4,314 remote-desktop sessions in six hours, roughly one every five seconds, straight through the night. That is a password list being worked through from end to end.
The usernames were sa, admin and root. The passwords were blank, 123, password and admin. A blank password was tried 624 times. Every one of those appears in every published password dump, so a login using one is standing open.
This is the one that would have hurt. Attackers asked the decoy for the credentials it uses to talk to its cloud provider, the digital keys to the whole account. That trick turns a small website bug into control of everything you run online.
On four occasions between 28 October and 1 November, somebody got far enough to upload and start a program. Every one was a cryptocurrency miner or the tool that hides one.
Romania
A program built to hide itself, 1.6 MB
Logged in as root with the password password
Pakistan · Hamdard University, Karachi
A cryptocurrency miner, 28.8 MB
Logged in as root with the password debian
China
A cryptocurrency miner, 864.0 KB
Logged in as root with the password debian
United States
A cryptocurrency miner, 28.3 MB
Logged in as root with the password debian
Three of the four typed root with the password
debian. The fourth used root with
password. Four different operators in three countries, and the same
two guesses. That is a botnet at work: it knocks, guesses the default, drops a
miner, disconnects and moves to the next address.
None of it ran on a real computer. The decoy accepted the upload, recorded it, and stopped there.
| Entry point | Attempts seen | What it would have meant |
|---|---|---|
| Windows file sharing | 211,163 | Ransomware spreading machine to machine across an office, encrypting everything it reaches. |
| Websites | 40,576 | A defaced site, a hidden back door, or a stolen customer database. |
| Remote desktop | 93,440 | Somebody sitting at your computer with your permissions, reading files and locking you out. |
| Remote login (SSH) | 40,424 | Full control of that machine, usually to add it to a network of hijacked computers. |
| Old telnet login | 19,343 | Command-line control over equipment that was never meant to face the internet. |
| Databases | 15,630 | Everything inside copied out, often with no sign it happened. |
| Cloud account keys | 790 | Control of your entire cloud account: data, backups and billing. |