SSH honeypots mostly capture bot activity
Analytics2026-07-06, 10:53
Researchers from the Czech Republic analyzed activity from 11 SSH honeypots and examined attacker behavior after a successful login. Over 15 days, they recorded 117,622 SSH sessions, and 99.23% of them were non‑interactive.
This means that after authentication, the client sends one or two commands via an SSH exec request, the server executes them without launching an interactive shell, and then instantly closes the connection once the result is returned.
Only in 0.1% of cases was an interactive shell launched — the kind of session where attacker behavior can actually be observed. Traditionally, SSH honeypots have focused on such sessions. The rest of the activity comes from automated scripts and scanners:
• The 10 most frequent commands account for 41.59% of all traffic and are primarily used to gather basic system information.
• 2,178 sessions showed bots checking whether the commands were really executed on the server (i.e., testing whether the environment is "real" or not).
• Some requests tried to detect the presence of a honeypot itself — for example, by looking for Cowrie or Kippo processes or checking system file availability.
Historical data from CZ.NIC (the Czech ccTLD registry) indicates this isn't a new phenomenon: an observation archive since 2017 (over 400 million sessions) shows that non‑interactive traffic has dominated since 2018.
The main takeaway from the research is the challenge of measuring honeypot effectiveness. It's often gauged by how long an attacker stays in the system or how many commands they execute. In reality, nearly all traffic consists of single requests completed in fractions of a second, making such metrics unreliable for assessing true threat activity. Therefore, SSH honeypot logic should shift toward detecting patterns in these short interactions to identify broader attack campaigns.
Vendors
Products