Non-interactive SSH attacks dominate after login

A study of eleven SSH honeypots (with corroboration from CZ.NIC data) found that 99%+ of authenticated sessions are non-interactive single-command probes—automated scanners confirming host characteristics—while interactive shells are rare. The most common commands gather basic system facts (uname, CPU count, uptime), and some scanners perform quick checks to detect honeypots or verify command execution; this trend has been dominant since ~2018 and affects how honeypot success should be measured.