Until recently I did not know that honeypots I encounter are based on Cowrie. But it does not change much to be honest. I already seen almost 100 of these while randomly exploring things on the internet. It was first thought that they are honeypots, by pure intuition. You enter a system and run ps to list processes and see broad range of things like: ejabberd (erlang) nginx worker process VBoxService mysqld But on the other hand you are unable to run top command or any other which normally are available on valid systems. Then comes to your mind that