Honeypot in Ukraine

Buried in a piece of malware that landed on my server was the string im in deep sorrow. No idea if it was a mood or a joke. The C2 (command server) was in Greece.

I'd left a honeypot running in Ukraine for a month, (NotPetya country, active conflict zone, history of state-sponsored attacks) half expecting something dramatic. What I got was three million automated probes, a Vietnamese-speaking credential thief, and a rickroll.

The Ukraine location turned out not to matter. What I found instead was a window into the internet's background radiation of crime, constant, automated, and completely indifferent to where your server is.

One month of attacks

~3 million events. One per second, around the clock, for 30 days. Credential stuffing, cryptominer deployments, toll fraud on the VoIP honeypot, research scanners openly identifying themselves, industrial control systems probed for vulnerabilities. All automated, all indifferent to where the server was. Here's what was actually interesting.

Not exactly criminal masterminds

A scanner from the Netherlands 85.11.167.11 trying to enumerate PostgreSQL ports sent the username taiga with passwords like port=6543, port=15432, a connection string parser bug leaking the port field as the password.

The very same server also attempted to use the username pgg_superadmins, a specific PostgreSQL internal role, with a 32-character MD5 hash as the password. PostgreSQL stores password hashes in its pg_shadow table, so someone had clearly dumped a real database. They just didn't realise you can't log in with a hash. They had real stolen credentials and couldn't use them.

Someone looking for something specific

A request came in from 61.145.74.246, an IP from China, querying for "阿里网商" (Alibaba merchant), "支付宝催收" (Alipay debt collection), "阿里集团网上银行" (Alibaba Group online banking). Someone was hunting for a specific leaked Chinese fintech dataset that circulates in underground markets, and checked this Ukrainian honeypot on the off chance it was a real exposed database.

The malware

Some honeypots don't just log connection attempts, they simulate an environment where the attacker can actually download and run things. A few samples from what landed.

"im in deep sorrow"

A cryptominer deployed from Brazil 45.205.1.8 connected to a C2 on a Greek IP. Buried in the binary: im in deep sorrow.

No idea if it was a mood or a joke. I choose to believe they were having a rough day.

xinchao

A payload from Angola 105.174.128.18 landed on the server and pulled down two encrypted zip archives. The password was hardcoded in the binary — xinchao123, Vietnamese for "hello123."

Inside: Tor and Mimikatz, a tool for extracting saved passwords from Windows memory. C2 routed through Tor, so no IP to follow. Someone said hello and came prepared.

One more

Another cryptominer and Mirai sample deployed from Seychelles (Africa) 196.251.107.133 had a YouTube link hardcoded into it. It was, of course, a rickroll.

Conclusion

Somewhere out there, a Greek malware author is having a terrible day. A Vietnamese one said hello and someone still thinks rickrolling is funny. Criminals are still very human.

PS: If you want to run something like this yourself, I used T-Pot — battle-tested and easy to set up. One thing worth considering: you're attracting real malware, so good hygiene matters. Keep everything inside an isolated VM, route your traffic through a Whonix Gateway so your home IP never touches attacker logs, and use a no-KYC VPS paid with Monero.