A honeypot sitting quietly in the dark. No announcements. No inbound links. The scanners find it anyway — drawn to any open port like creatures to a light at the bottom of the sea. This is what they do when they think no one is watching.
Cowrie grants every attacker a convincing shell. What follows is a reliable playbook: enumerate the host, check for miners, drop a payload, disappear. Sometimes they’re hunting Solana nodes. Sometimes Telegram sessions. Always automated.
A Raspberry Pi 4 running Cowrie, exposed on a non-standard port. Events stream through Cloudflare Workers, enriched with geo and threat intel, and stored permanently in D1 for analysis and historical search.
cowrie.json and POSTs batches
to a Cloudflare Worker every 30 seconds. Events are authenticated, geo-enriched
via ip-api.com, and scored against AbuseIPDB before storage.
The honeynet is expanding. Each node exposes a different attack surface. All events flow into the same feed.
The feed is live. Events are real. All IPs are anonymized. No accounts, no tracking — just the data.