A honeypot sitting quietly in the dark. No announcements. No inbound links. The scanners find it anyway — drawn to any open port like creatures to a light at the bottom of the sea. This is what they do when they think no one is watching.
Cowrie grants every attacker a convincing shell. What follows is a reliable playbook: enumerate the host, check for miners, drop a payload, disappear. Sometimes they're hunting Solana nodes. Sometimes Telegram sessions. Always automated.
A Raspberry Pi 4 running Cowrie, exposed on a non-standard port with no credentials worth stealing. Events stream from the Pi to bathysphere.tech, updating the feed in near real-time.
cowrie.json and POSTs
new events to a Cloudflare Worker endpoint every 30 seconds.
Events are validated, enriched, and written to KV storage.
wrangler pages deploy on git push.
The honeynet is expanding. Each node exposes a different attack surface. All events flow into the same feed.
The feed is live. Events are real. All IPs are anonymized. No accounts, no tracking — just the data.