Hit 1,000 breaches catalogued in my home lab, and 3 patterns jumped out

I've been running a small honeypot setup out of my spare bedroom for about two years now, logging every attempted intrusion I can catch. Last Tuesday I crossed 1,000 recorded breach attempts, which felt like a solid milestone for a hobby project. What surprised me most was that 37% of them were brute force attempts on my SSH port using the same handful of common passwords, things like admin, 123456, and password. Another 22% were old Windows exploits from 2017 that still get tried constantly, which tells me attackers don't care about fancy tricks, they just go for easy targets. The rest were a mix of SQL injection tries on a dummy web server I run just for this, and some weird IoT bot traffic. It really drove home that patching basics and using strong, unique passwords probably stop most attacks before they even start. Has anyone else run a honeypot and noticed a specific attack they didn't expect to see so often?

0 comments

0 Comments

No comments yet

Be the first to share your thoughts on this discussion.