Hunang
Archived SSH and Telnet honeypot field study with a public report and anonymous results
Hunang, Icelandic for *honey*, ran an internet-facing SSH and Telnet honeypot. The sensor was powered off on 2026-09-25. Its public archive presents an English report and the final anonymous results: attack volume, source countries and networks, credential guesses, and observed behavior mapped to MITRE ATT&CK.
The experiment used an isolated Cowrie sensor, a TypeScript shipper, and an ingest service backed by PostgreSQL. Source addresses were pseudonymized at ingest. The archive site now reads a dated rollup snapshot without contacting the stopped sensor, ingest service, or database.
Hunang went live on 2026-08-06 at hunang.kastro.is; the first recorded attack arrived 23 seconds later. The source code and data-handling notes are public.