Honeypot

First five hours of honeypot activity: 191 sessions, 4,535 events, 2,322 commands, 90 simulated logins, 146 download events, and two Mirai variants.

I Put One Disposable IP on the Internet. Five Hours Later, Mirai Showed Up.

A fresh, isolated cloud VM attracted 191 sessions, 2,322 attacker commands, two Mirai variants, and an SSH tunnel attempt in about five hours.

August 10, 2026 · 4 min · 731 words · Justin