🍯 Live Honeypot Server for Attack Pattern Analysis

A cloud-deployed, medium-interaction SSH/Telnet honeypot that attracts, detects, logs, and blocks real-world cyberattacks in real time.

Deployed on Microsoft Azure with automated intrusion prevention via Fail2ban — capturing attacker IPs, credentials, and commands for threat intelligence analysis.

---

📋 Table of Contents

• Objective
• Architecture
• Tech Stack
• Deployment
• Log Analysis
• Visualization
• Key Findings
• Future Scope

---

🎯 Objective

Deploy a functional honeypot system that can:

Capability	Description
Deploy	Run on a cloud VM accessible from the public internet
Attract	Emulate SSH/Telnet services to lure automated attacks and manual intrusions
Log	Capture source IPs, credentials attempted, and commands executed per session
Analyze	Identify trends, repeated patterns, and common attack vectors from log data
Block	Automatically ban persistent attackers via Intrusion Prevention System (IPS)
Visualize	Map attacker geolocations using IP intelligence services

---

🏗️ System Architecture

                    ┌──────────────────┐
                    │   INTERNET       │
                    │   (Attackers)    │
                    └────────┬─────────┘
                             │
                    ┌────────▼─────────┐
                    │  Azure NSG       │
                    │  Firewall Rules  │
                    │  Port 2222/2223  │
                    └────────┬─────────┘
                             │
              ┌──────────────▼──────────────┐
              │     Azure VM (B1s)          │
              │     Ubuntu 22.04 LTS        │
              │                             │
              │  ┌────────────────────┐     │
              │  │  Cowrie Honeypot   │     │
              │  │  SSH  → Port 2222 │     │
              │  │  Telnet → Port 2223│     │
              │  │                    │     │
              │  │  cowrie.log ──────┐│     │
              │  └────────────────┘  ││     │
              │                      ││     │
              │  ┌────────────────┐  ││     │
              │  │   Fail2ban     │◄─┘│     │
              │  │   IPS Engine   │   │     │
              │  │   3 strikes →  │   │     │
              │  │   1hr ban      │   │     │
              │  └────────────────┘   │     │
              │                       │     │
              │  Port 22 → Admin SSH  │     │
              │  (RSA key auth only)  │     │
              └───────────────────────┘     │

---

🛠️ Tech Stack

Component	Technology	Version	Purpose
Cloud Platform	Microsoft Azure	—	VM hosting, public IP, Network Security Groups
Operating System	Ubuntu Server	22.04 LTS	Stable, secure Linux distribution
Honeypot	Cowrie	Latest	Medium-interaction SSH/Telnet honeypot
IPS	Fail2ban	Latest	Log monitoring, automatic IP banning
Auth	RSA Key Pair	—	Secure admin access (password auth disabled)
Isolation	Python venv	—	Dependency isolation for Cowrie
Visualization	IP Geolocation	—	Attack origin mapping via ipinfo.io

---

⚙️ Deployment & Configuration

1. Virtual Machine Provisioning

• Created Ubuntu 22.04 LTS VM (B1s size) on Microsoft Azure
• Configured secure admin access via RSA private key (password authentication disabled)
• Assigned public IP for internet-facing honeypot services

2. Firewall Configuration (Azure NSG)

Port	Protocol	Service	Purpose
22/TCP	SSH	Admin Access	Secure management (RSA key only)
2222/TCP	SSH	Cowrie Honeypot	SSH trap for attackers
2223/TCP	Telnet	Cowrie Honeypot	Telnet trap for attackers

3. Cowrie Honeypot Installation

# Create dedicated low-privilege user (principle of least privilege)
sudo adduser --disabled-password cowrie

# Clone and configure Cowrie
git clone https://github.com/cowrie/cowrie.git /home/cowrie/cowrie
cd /home/cowrie/cowrie

# Isolate dependencies in virtual environment
python3 -m venv cowrie-env
source cowrie-env/bin/activate
pip install -r requirements.txt

# Launch honeypot on ports 2222 (SSH) and 2223 (Telnet)
bin/cowrie start

4. Fail2ban Integration (Active Defense)

Custom filter — /etc/fail2ban/filter.d/cowrie.conf:

[Definition]
failregex = ^.*\[HoneyPotSSHTransport,.*,<HOST>\].*login attempt.*failed$
ignoreregex =

Custom jail — /etc/fail2ban/jail.local:

[cowrie]
enabled  = true
port     = 2222
filter   = cowrie
logpath  = /home/cowrie/cowrie/var/log/cowrie/cowrie.log
maxretry = 3
bantime  = 3600

Policy: After 3 failed login attempts → IP is banned for 1 hour via iptables.

---

📊 Log Analysis & Attack Patterns

The honeypot captured hundreds of automated attack attempts within hours of deployment. Analysis commands for the cowrie.log file:

Top Attacker IP Addresses

grep "login attempt" cowrie.log | awk -F'[, ]' '{print $4}' | sort | uniq -c | sort -nr | head -n 10

Top Usernames Attempted

grep "login attempt" cowrie.log | sed 's/.*\[b//;s/\/.*//' | tr -d "'" | sort | uniq -c | sort -nr | head -n 10

Top Passwords Attempted

grep "login attempt" cowrie.log | sed 's/.*\///;s/\].*//' | tr -d "'" | sort | uniq -c | sort -nr | head -n 10

Common Attack Patterns Observed

Pattern	Details
Credential Stuffing	Automated bots attempting root/admin/test with common passwords
Default Credentials	Attempts with factory defaults (admin:admin, root:123456)
Dictionary Attacks	Systematic wordlist-based password spraying
Persistence Attempts	Repeated connections from the same IP ranges

---

🌍 Visualization & Reporting

Attack origin mapping workflow:

1. Extract unique attacker IPs from Cowrie logs
2. Geolocate via ipinfo.io API → latitude/longitude coordinates
3. Plot on a world map using Google My Maps or Tableau Public

# Extract unique IPs for geolocation
grep "login attempt" cowrie.log | awk -F'[, ]' '{print $4}' | sort -u > attacker_ips.txt

# Geolocate via API
while read ip; do
  curl -s "https://ipinfo.io/$ip/json" >> geo_data.json
done < attacker_ips.txt

---

🔑 Key Findings

Metric	Observation
Attack Speed	Automated scans detected within minutes of deployment
Top Usernames	root, admin, test, user, ubuntu
Top Passwords	123456, admin, password, root, 1234
Attack Origins	China, Russia, Vietnam, India, Brazil (typical botnet sources)
Fail2ban Blocks	Effectively reduced repeated attacks from persistent IPs

---

🔮 Future Scope

Enhancement	Description
Splunk/Wazuh	Centralized SIEM for real-time log analysis and dashboarding
ELK Stack	Elasticsearch + Logstash + Kibana for advanced visualization
Threat Intel Feeds	Correlate attacker IPs with known threat intelligence databases
High-Interaction	Upgrade to full OS emulation for deeper attacker behavior analysis
Automated Reporting	Python scripts for daily attack summary reports

---

📄 Documentation

The full project report is available as a PDF in this repository:

• ELEVATE_LABS_FINAL INTERNSHIP _PROJECT.pdf — Complete internship report with detailed analysis

---

👤 Author

Harsh Gupta — @cazy8 · LinkedIn

---

If you found this useful, consider giving it a ⭐