violet honeypot server

outcome

Captured 20,000+ login attempts worldwide and analysed attacker methods and origins, demonstrating end-to-end system design and threat analysis. (The server is occasionally offline to save running costs.)

the problem

Understand how real-world brute-force SSH and Telnet attacks actually behave.

what i built

• Cowrie honeypot on AWS EC2 simulating SSH/Telnet ports (22, 80, 443, 2222) to capture global login attempts
• Python + cron automation parsing JSON logs into MySQL every 5 minutes
• Analytics and ML with Pandas, Matplotlib and Seaborn, plus Isolation Forest for anomaly detection
• IP geolocation map via the ipdata API by country and ASN
• Interactive PHP dashboard with a live attack counter, charts and a review system

stack

links