NewsPublished 8 Apr 2026

More Honeypot Fingerprinting Scans, (Wed, Apr 8th)

Source SANS ISC Handlers Diary

Description

One question that often comes up when I talk about honeypots: Are attackers able to figure out if they are connected to a honeypot? The answer is pretty simple: Yes!

Impact

The impact is limited to attackers being able to detect honeypots, which may reduce the effectiveness of honeypots as deception tools. This detection does not directly compromise systems but may allow attackers to avoid or evade honeypots during reconnaissance. There is no indication of exploitation beyond fingerprinting, and no known exploits in the wild are reported.

Defensive guidance

The honeypot operator currently does not consider it necessary to hide honeypots from fingerprinting attempts. Operators should be aware that medium interaction honeypots like Cowrie can be detected through these methods. Mitigation could involve enhancing honeypot realism or limiting attacker feedback, but such measures are not currently implemented or recommended by the operator. No urgent action is required.

Summary

This threat involves attackers performing fingerprinting scans to detect medium interaction honeypots such as Cowrie, which emulate SSH and telnet services. Attackers exploit the incomplete simulation of these honeypots by attempting to install fake packages that appear to succeed, checking SSH cipher artifacts, and using improbable username/password pairs that should fail on real systems. If these attempts succeed, attackers confirm the presence of a honeypot. The honeypot operator notes that while this fingerprinting is common, it is not currently mitigated or hidden extensively, partly due to the ephemeral nature of honeypot IP addresses and the focus on broad scanning rather than targeted attacks.

References

isc.sans.edu/diary/rss/32878 (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 8 Apr 2026, 14:36 UTC

References

Community reviews