violet honeypot v2

outcome

A full rebuild on a modern, zero-cost stack. Same core idea as v1 (lure attackers, record everything, visualise it) but now a high-interaction trap that captures entire attacker shell sessions, fronted by a live mission-control dashboard and a machine-learning threat-analysis page. Live at v2.violethoneypot.com, pulling in thousands of real attacks.

the problem

v1 proved the concept but hit real limits: it ran on a paid AWS box that quietly racked up bills (so it sat offline most of the time), it only recorded login attempts, and the whole thing was a single PHP page. I wanted the same idea done properly: always on, capturing far more, and free to run forever.

what i built

• High-interaction trap: Cowrie in proxy mode forwards attackers to a real, fully sealed backend VM, so it captures the entire post-login session (commands, downloads, keystrokes), not just the login attempts v1 saw
• Sealed by design: the backend has no outbound internet at the cloud layer, so even a rooted attacker cannot pivot, attack others, or mine crypto (the exact risk that gets cloud accounts banned)
• Python forwarder that tails the honeypot logs, enriches each source IP with geolocation, dedupes, and bulk-inserts into Postgres
• Live mission-control dashboard: real-time attack feed, a d3 world map of origins, KPI tiles, credential leaderboards, and an attacks-over-time chart
• ML threat-analysis page with four models: DBSCAN botnet-campaign clustering, a TF-IDF + Random Forest intent classifier (~90% accuracy) reading the captured commands, Isolation Forest anomaly detection, and a volume forecast
• Local-only admin console (control, raw sessions, intel) that is never deployed, so the public can never reach it even by trying to hack in

stack

links