Hunang

Hunang, Icelandic for *honey*, runs an internet-facing SSH and Telnet honeypot and publishes an honest accounting of the automated attacks that hit it. The public dashboard tracks attack volume, source countries and networks, credential guesses, and observed behavior mapped to MITRE ATT&CK, then explains the basic controls that would have stopped each attack class.

The sensor is deliberately isolated and treated as disposable. Cowrie emulates the shell, outbound traffic is restricted to the telemetry path and essential infrastructure, and the sensor has no credentials or network access to real systems. Source addresses are HMAC-pseudonymized and truncated at ingest, raw events expire after 30 days, and the public site only reads anonymous aggregate rollups.

The production system uses Cowrie, a TypeScript shipper, a hardened ingest and aggregation service backed by PostgreSQL, and a server-rendered Next.js dashboard. Hunang went live on 2026-08-06 at hunang.kastro.is; the first automated attack arrived 23 seconds later.