[All work](/work?type=work)

# Cowrie Honeypot Analysis

480,998 events from a Cowrie honeypot, and the question was what they actually show.

Academic security analysis. Python analysis, visualisation and report preparation.

![Original aggregate charts showing honeypot activity by hour of day and day of week.](https://cdn.sanity.io/images/qnuj1c4o/production/eb9fa1553969d9d252366ac9d329be76607ff513-4170x2969.png?w=1920\&q=80\&auto=format)

A login attempt on its own says very little, so the work went from aggregate counts down to sessions, because a session is what connects the attempt to the commands after it.

Charts cover timing, ports, credentials and command use, with query tools for looking closer at anything odd. The reports stay at the aggregate level, so individual addresses aren't reproduced.

## State

Two reports and the analysis code, from October 2025.

[All work](/work?type=work)