SSH Honeypot Lab

A research project observing internet SSH attacks using Cowrie.

Goals

• Observe SSH attacks
• Capture malware
• Analyze botnet behaviour
• Visualize attacker locations

Stack

• Cowrie
• Grafana
• Loki
• Promtail
• GeoIP

Network

Internet → Router → Cowrie (port 22 → 2222)