--- title: "Discussion on \"I Left Port 22 Open on the Internet for 54 Days. Here's Who Showed Up.\" | Hashnode" description: "Discussion on \"I Left Port 22 Open on the Internet for 54 Days. Here's Who Showed Up.\". A lone port 22, wide open, accepting every password. 269,000 connections, 7,556 unique IPs, and a few visitors who thought they'd hit the jackpot." url: "https://hashnode.com/posts/i-left-port-22-open-on-the-internet-for-54-days-here-s-who-showed-up/69ebbdb7b463d4844c3ea9ee" --- [Feed](https://hashnode.com/feed) / Discussion # [I Left Port 22 Open on the Internet for 54 Days. Here's Who Showed Up.](https://arman-bd.hashnode.dev/i-left-port-22-open-on-the-internet-for-54-days-here-s-who-showed-up?utm_source=hashnode&utm_medium=feed) A lone port 22, wide open, accepting every password. 269,000 connections, 7,556 unique IPs, and a few visitors who thought they'd hit the jackpot. Apr 24 · 14 min read · arman-bd.hashnode.dev Updated May 15 Read the article - [#ssh](https://hashnode.com/tag/ssh) - [#security](https://hashnode.com/tag/security) - [#passwords](https://hashnode.com/tag/passwords) - [#ssh-keys](https://hashnode.com/tag/ssh-keys) ## Written by [Arman Hossain](https://hashnode.com/@arman-bd) @arman-bd [View profile](https://hashnode.com/@arman-bd) Web Scraping Engineer A professional web scraper and data extraction expert with years of hands-on experience in turning the web’s scattered data into structured, actionable insights ## Responses 18 Markdown supported · ⌘↵ to post [Jenna Frank](https://hashnode.com/@jennafrank) [Oct 6](https://hashnode.com/posts/i-left-port-22-open-on-the-internet-for-54-days-here-s-who-showed-up/69ebbdb7b463d4844c3ea9ee/comment/6ac563dbb9fb66df236e3933) Hey, Arman! I came across your honeypot write-up here on Hashnode when I was just getting started in cybersecurity, and it inspired me to build my own. Your data confirmed Solana creds are among the most-sprayed on the internet, so I totally just leaned in and built my own SSH honeypot disguised as a Solana validator node. I never reached out to tell you, but I wanted to fix that! Here’s the project you inspired: jk.. my account is less than a month old so I can't share links... but If you check out my github it is my third project.. The Honeypots.. That honeypot collected 153 days of data, which eventually became the starting point for my first open-source contribution to Tyler Bohlmann’s Detection Chokepoints project. Tyler works at Huntress on the DE&TH team, and getting to learn through his reviews was such a cool experience. Here’s where it ended up: check out my github it's the first project - Choakpoints (I can't share links) I definitely didn’t see any of that coming when I first read your post. 😂 Thank you for sharing your work and inspiring others. It sent me down a really fun path, and I thought you should know! [w569638598](https://hashnode.com/@ahawen) [May 22](https://hashnode.com/posts/i-left-port-22-open-on-the-internet-for-54-days-here-s-who-showed-up/69ebbdb7b463d4844c3ea9ee/comment/6a0ffa091f237623eab49372) 啊哈？ [孟祥云](https://hashnode.com/@yun1) [May 21](https://hashnode.com/posts/i-left-port-22-open-on-the-internet-for-54-days-here-s-who-showed-up/69ebbdb7b463d4844c3ea9ee/comment/6a0e5c5c8b03460221cf4238) 有意思 [azk78](https://hashnode.com/@azk78l) [May 18](https://hashnode.com/posts/i-left-port-22-open-on-the-internet-for-54-days-here-s-who-showed-up/69ebbdb7b463d4844c3ea9ee/comment/6a0af694e4a28cf5700aa26f) 我草，赶紧改密码，查了一下：SSH暴力破解统计报告 统计周期: 2026-05-01 ~ 2026-05-18 | 失败登录总数: 11,398 次 [Yanyo Li](https://hashnode.com/@yanyo) [May 17](https://hashnode.com/posts/i-left-port-22-open-on-the-internet-for-54-days-here-s-who-showed-up/69ebbdb7b463d4844c3ea9ee/comment/6a093b315b726333fdc9fade) Super super interesting! [a1rookie](https://hashnode.com/@einsam) [May 16](https://hashnode.com/posts/i-left-port-22-open-on-the-internet-for-54-days-here-s-who-showed-up/69ebbdb7b463d4844c3ea9ee/comment/6a0804cd5adec46063306e4d) very good，from china [w569638598](https://hashnode.com/@ahawen) [May 22](https://hashnode.com/posts/i-left-port-22-open-on-the-internet-for-54-days-here-s-who-showed-up/69ebbdb7b463d4844c3ea9ee/comment/6a0804cd5adec46063306e4d#reply-6a0ffbeb1f237623eab5deb6) AI翻译一下，说的地道点再回复。 [NicLav](https://hashnode.com/@niclav) [May 15](https://hashnode.com/posts/i-left-port-22-open-on-the-internet-for-54-days-here-s-who-showed-up/69ebbdb7b463d4844c3ea9ee/comment/6a0742b573afc88757858868) Very interesting read; I'm curious to see the Python script if you share it. [Alex](https://hashnode.com/@rdup) [May 1](https://hashnode.com/posts/i-left-port-22-open-on-the-internet-for-54-days-here-s-who-showed-up/69ebbdb7b463d4844c3ea9ee/comment/69f4a081ec32cba9e50b8f7b) Excellent work, congratulations. I'm curious to see the results of your honeypot running on a random port, different from port 22. [G Teodoro](https://hashnode.com/@teodororo) [Apr 28](https://hashnode.com/posts/i-left-port-22-open-on-the-internet-for-54-days-here-s-who-showed-up/69ebbdb7b463d4844c3ea9ee/comment/69f0103f330a1ad7f74715d3) Very insightful, thanks for sharing! [Tenfold Strong](https://hashnode.com/@tenfoldstrong) [Apr 27](https://hashnode.com/posts/i-left-port-22-open-on-the-internet-for-54-days-here-s-who-showed-up/69ebbdb7b463d4844c3ea9ee/comment/69ef7409330a1ad7f7edb37d) I'm surprised the logs were only 317MB tbh ... [Arman Hossain](https://hashnode.com/@arman-bd) [Apr 27](https://hashnode.com/posts/i-left-port-22-open-on-the-internet-for-54-days-here-s-who-showed-up/69ebbdb7b463d4844c3ea9ee/comment/69ef7409330a1ad7f7edb37d#reply-69efa37b330a1ad7f70e8003) Possibly due to the domain / IP not being too popular. [Carter Stach](https://hashnode.com/@spycoder77) [Apr 26](https://hashnode.com/posts/i-left-port-22-open-on-the-internet-for-54-days-here-s-who-showed-up/69ebbdb7b463d4844c3ea9ee/comment/69ee90683d6a492cdd5bfefa) Can you open source the python? [Arman Hossain](https://hashnode.com/@arman-bd) [Apr 26](https://hashnode.com/posts/i-left-port-22-open-on-the-internet-for-54-days-here-s-who-showed-up/69ebbdb7b463d4844c3ea9ee/comment/69ee90683d6a492cdd5bfefa#reply-69ee95103d6a492cdd5e8b45) Will do for sure, and once I do I'll make sure to comment back here. [Alex](https://hashnode.com/@securexandra) [Apr 26](https://hashnode.com/posts/i-left-port-22-open-on-the-internet-for-54-days-here-s-who-showed-up/69ebbdb7b463d4844c3ea9ee/comment/69ee3a143d6a492cdd1fe22f) Useful read for developers and ops teams. Hope it sparks better defensive practice. [Arman Hossain](https://hashnode.com/@arman-bd) [Apr 26](https://hashnode.com/posts/i-left-port-22-open-on-the-internet-for-54-days-here-s-who-showed-up/69ebbdb7b463d4844c3ea9ee/comment/69ee3a143d6a492cdd1fe22f#reply-69ee69163d6a492cdd423d7a) Thank you for your feedback. [Bulat Yakupov](https://hashnode.com/@yakupovbulat) [Apr 26](https://hashnode.com/posts/i-left-port-22-open-on-the-internet-for-54-days-here-s-who-showed-up/69ebbdb7b463d4844c3ea9ee/comment/69ee2dfb3d6a492cdd182516) That is beautiful [Arman Hossain](https://hashnode.com/@arman-bd) [Apr 26](https://hashnode.com/posts/i-left-port-22-open-on-the-internet-for-54-days-here-s-who-showed-up/69ebbdb7b463d4844c3ea9ee/comment/69ee2dfb3d6a492cdd182516#reply-69ee68e83d6a492cdd421f19) Thank you for your feedback.