DShield's Cowrie honeypots logged 1,206,566 telnet/SSH sessions from 2022-04-13 to 2026-03-21. Most sessions ran about 20 commands and lasted about 20 seconds, with the modal command count at 22 and most sessions under 30 commands. Researchers concluded that session-length and final-command fingerprints can serve as triage signals to distinguish high-volume automated bot noise from interactive or novel attacker sessions.
Part of the PlainSec briefing for 2026-03-30