Tripwire

A real honeypot on the public internet. Every attacker session is enriched with threat intel and summarised by Claude.

Loading…

About

Tripwire runs an emulated SSH/Telnet honeypot (Cowrie) on an isolated, disposable server. Connections are logged, parsed into alerts by Wazuh, enriched with GeoIP and IP-reputation data, then summarised and scored 1–5 by Claude. Nothing here is a real production system, and the honeypot is never actually compromised.

Passive logging only. No counter-hacking, no scanning back, no retaliation. Source addresses are attacker-controlled or spoofed and are shown for situational awareness, not attribution or doxxing.