Show HN: Real-Time Observation of Bot Activity via SSH Honeypot

Research and Privacy Disclosure: This interface provides a live stream of telemetry captured by an SSH honeypot. Its primary goals are educational outreach, threat intelligence gathering, and security research.

📊 Data Overview

The dashboard aggregates various metadata from incoming connection attempts. The captured dataset $D$ can be represented as: $D = \{ \text{IP}_{source}, \text{User}, \text{Pass}, \text{Cmd}, \text{Fingerprint}, \dots \}$

⚠️ Critical Warnings

It is imperative to understand that the data displayed is untrusted.

• Attribution: A source IP identifies the attacker does not necessarily identify the human operator. The IP could be a:
  • Compromised host
  • VPN or Proxy
  • Cloud instance
  • Botnet node
  • Network scanner
• Safety: The telemetry may contain malicious URLs, public keys, or malware delivery payloads.
  • Warning: Do not execute any code found here.

Safety Checklist for Researchers

• Treat all commands as potentially malicious.
• Avoid clicking untrusted URLs.
• Do not assume IP-based attribution is verified.

🛠️ Technical Flow

The following diagram illustrates how the telemetry reaches the dashboard:

💻 Example Log Entry

While the current view may be empty, a typical event might look like this in the backend:

# Incoming connection event
EVENT_TYPE: auth_failure
SRC_IP: 192.0.2.1
USER: root
PASS: 123456
CLIENT_FP: ssh-2.0-OpenSSH_8.2p1

📩 Administration

If you encounter any data that raises concerns regarding privacy, security, or abuse, please contact the site administrator to request a review or the removal of the specific entry.

---

Current Dashboard State:

• Filter: All sessions (No specific filter active) $\times$
• Event Count: 0 events
• Event Types: 0 $\times$
  • (Note: New event types are integrated automatically and enabled by default.)