HONEYPOT // Threat Operations Center

A live Ubuntu VPS honeypot capturing real-time internet-wide exploit attempts, brute-force campaigns, and malware stagers across SSH, Telnet, SMB, MSSQL, MySQL, and HTTP attack surfaces.

Cowrie Security Boundary

SSH/Telnet Interactive Honeypot

BIND: :22→2222 :23→2223

Emulates Debian/Ubuntu shells. Captures brute-force credentials, interactive terminal commands, and malware download attempts.

Dionaea Malware Ingestion Matrix

Network Service Emulation Trap

BIND: :445→4545 :1433→14433 :3306→33306

Simulates vulnerable Windows SMB, MSSQL, and MySQL daemons. Captures exploit payloads and shellcode stagers.

Nginx Enterprise Web Edge Trap

HTTP Application-Layer Trap

BIND: :80 :443

Transparently intercepts HTTP/HTTPS scanner traffic. Routes malicious URI patterns into forensic signature logs with TLS handshake telemetry. Serves decoy SSL cert to raw IP probes.

0

TOTAL

0

UNIQUE IPs

0

WEB EXPLOITS

24h

RANGE

◉ Global Threat Cartography

☃ Port Telemetry

SSH (22)

0

TELNET (23)

0

HTTP (80)

0

SMB (445)

0

MSSQL (1433)

0

MySQL (3306)

0

● Cowrie Terminal

[Loading historical data...]

♦ Brute-Force Credential Directory

Loading...

Loading...

☢ Dionaea Service Exploitations

TIMESTAMP	ATTACKING IP	TARGET SERVICE	PAYLOAD DETAILS
No exploit payloads intercepted

🌎 Nginx Edge Web Violations

TIMESTAMP	ATTACKING IP	EXPLOIT VECTOR / TARGET URI	CIPHER PROFILE
No web violations intercepted

Click an event row, port card, or ASN entry to inspect.

Loading...

CPU--%

MEM--%