My Docker SSH Honeypot in AWS…

Botnet
So the other day I decided to try make a honeypot using docker and found a great little project https://github.com/droberson/ssh-honeypot

The final version of the SSH honeypot was this..
https://hub.docker.com/r/txt3rob/docker-ssh-honey/

So I fired it up in shipyard (nice web gui for docker) and put this in AWS on the free tier to test.

The results after 20 hours so far are!

Top 10 Passwords

AttemptsPassword
10584412345
105603 admin
1052941234
80685default
56272000000
56133seiko2005
56114anko
56074rpitc
55936dreambox

TOP 10 IPS

AttemptsIP
32079578.202.148.107
284757181.22.136.138
212777119.193.140.220
203166201.178.11.7
142683223.80.99.37
139977218.60.136.106
116821122.159.27.193
10497261.160.196.107
82589119.193.140.215
71272190.45.3.201

I am happy to supply any one the logs of these containers if you wish to use them for your own research just message me on twitter @random_robbie.