Cowrie Honeypot

The idea

I wanted a better understanding of the background noise that reaches an exposed service, rather than only reading about it.

The build

I deployed Cowrie on a VPS and used it as a safe way to observe interactions with a simulated SSH service and collect logs for investigation.

Problems & investigation

• Reviewing patterns in connection and command activity
• Separating automated behaviour from more general probing
• Learning how exposed services are discovered

What I learned

• Internet-facing services attract attention quickly
• Logs become more useful when reviewed with a clear question
• Defensive security starts with understanding what is visible

What's next

Continue investigating the collected activity and improve how the observations are organised for review.