Scans for SSHole vulnerability (CVE-2026-123158) increase in honeypots
Honeypots report increase in SSH attacks for sshole starting November 1, with first exploits on November 5.
Stories per day · 30 days
4 stories, newest first · one card per story
Stories tagged #cowrie
TTY Logs and the Data it Captures, (Sun, Oct 4th)
SANS diary correlates DShield honeypot TTY logs, finding one crontab pattern used by over 3,130 IPs.
Redtail Payload Analysis [Guest Diary], (Wed, Sep 9th)
SANS guest analyst detonated a RedTail Linux sample from a DShield honeypot, finding process masquerading as php-fpm, monitoring-kill behavior, and a TCP listener.
Honeypot-Omaha and batch.py [Guest Diary], (Wed, Sep 2nd)
A SANS ISC guest diary describes batch.py, a Python tool that consolidates honeypot logs and enriches IOCs with threat intelligence data.