More Honeypot Fingerprinting Scans, (Wed, Apr 8th)

The author describes how attackers can detect medium-interaction honeypots (Cowrie) by observing simulated package installs, SSH artifacts, and by attempting unlikely username/password combinations; the post provides an example IP (45.135.194.48) and a table of credentials the attacker tried, and concludes that the operator is unlikely to hide honeypots since they focus on broad internet-wide scans rather than targeted attacks.