Honeypot-Omaha and batch.py [Guest Diary], (Wed, Sep 2nd)

This guest diary documents activity captured by the Honeypot-Omaha DShield cowrie sensor: repeated automated credential-guessing and telnet/SSH interactions, several successful SSH sessions with commands executed (e.g., uname, BusyBox usage, file deletions), and indications of data collection; the author describes building a Python tool (batch.py) that aggregates logs, queries APIs (ip-api.com, cve.org, paloaltonetworks.com), produces TSV reports and pie-chart visualizations, and investigators' follow-up research into an ISP (PPTECHNOLOGY LIMITED) and observed indicators such as an SSH client fingerprint.