A bot checked a fake server with four NVIDIA H100s 38 times

The authors of a Habr article launched a Cowrie SSH honeypot posing as a server for training neural networks with four NVIDIA H100s. The first outside bot connected six minutes after launch.

In its first 12.5 hours, from 16:20 UTC on October 24 to 04:59 UTC on October 25, the honeypot recorded 1,846 connections from 126 addresses. The authors clarify that successful logins reflect the honeypot’s settings, which let sufficiently persistent bots through, not the strength of the passwords.

One bot returned 38 times. During its first 34 visits, an emulation bug in the grep command gave it an empty result when it checked the GPUs with lspci. After the bug was fixed, the bot visited four more times, saw four H100s, and disappeared.

Image: Charbax CC BY 3.0 · License

Translation editors: Соловьев В., Пеков А.