Building my first honeypot on AWS

I've spent most of my time in IT Support handling tickets, MFA resets, and onboarding new hires — not touching cloud infrastructure directly. Today I wanted to change that, so I gave myself one goal: launch a real AWS server, put something live on the internet, and see what actually happens to it.

•  Launching the instance

I picked the simplest possible starting point — a `t3.micro` running Ubuntu, free-tier eligible, with a $100 credit covering the cost. No key pair, connecting straight from the browser through EC2 Instance Connect. Within a few minutes I had a real public IP and a real terminal into a machine I'd never touched before.

•  Putting something live

First step was nginx, just to prove I could serve something. Then I built a personal page — hand-written HTML and CSS, deployed by pasting the file into `nano` over SSH. It's a small thing, but it was the first server I've ever owned end to end.

Then I got curious about who else was watching

Any public IP gets scanned constantly — that's just background noise on the internet. Instead of ignoring it, I set up [Cowrie](https://github.com/cowrie/cowrie), a fake SSH server that pretends to be a real Linux box on port 2222. Anyone who connects gets a convincing fake shell — `whoami`, `uname -a`, even a fake `/etc/passwd` — and every command they type gets logged.

I set it up under `systemd` so it survives reboots, opened the port to the world, and within a few hours the first scanner found it — connected, grabbed the banner, and disconnected in 34 milliseconds. No login attempt, no commands. Just reconnaissance, the internet doing what it always does.

• What I actually learned

- Launching a real EC2 instance is a lot less scary than it sounds — the free tier and a small credit make it safe to experiment.
- A public IP gets attention within hours, not days. That surprised me.
- Logging is the whole point of a honeypot — the fake shell is just bait, the log file is the actual value.
- Deploying by hand (nano over SSH) is slow but it forced me to understand every file instead of copy-pasting a script I didn't read.

Next up: getting a free domain and real HTTPS on this site, and writing up whatever the honeypot picks up over the next few days.