Azure SSH Honeypot

Fri, 16 Oct 2026 00:00:00 +0000

A small Azure VM that sits on the open internet and records who attacks it: brute-force logins, the commands attackers type, the malware they try to download, and probes against every other TCP port.

The goal is to deliberately invite attacks without becoming a risk to myself or anyone else. Most of the work went into the second half of that sentence.

The setup

 ┌──────────────── Azure NSG ────────────────┐
 Internet ─────────►│ 22222 from my IP ......... allow │
 │ 22222 from anyone else ... deny │
 │ any other TCP port ....... allow (bait) │
 └─────────────────────┬─────────────────────┘
 ▼
 vm-honeypot (Ubuntu 24.04, Standard_B1s)
 :22 ──Docker──► Cowrie :2222 fake SSH
 :23 ──Docker──► Cowrie :2223 fake Telnet
 :22222 ──────────► sshd real SSH (me)
 other ──────────► nothing → logged as SCAN

It’s built in three layers, each with one job:

Projects on alcodes

Azure SSH Honeypot

The setup