CanaryDash honeypot: final dataset (2026-10-14 to 2026-10-23)

Prebuilt SQLite databases for the static dashboard in the GitHub repo ungleicch/canarydash-honeypot. They were built once from the raw logs in that repo, so you don't have to rebuild them. The repo's ./setup.sh downloads these files, checks their sha256 and starts the dashboard.

Attacker-only data. Everything here is traffic that internet bots and scanners sent to a honeypot (an Azure VM running OpenCanary and Cowrie SSH/Telnet). It's the same content as the public logs in the GitHub repo: no owner credentials, keys or personal data. IPs, usernames/passwords, commands and URLs were typed by attackers. Malware binaries are not included (hashes and URLs only).

• Period: 2026-10-14 20:51 PDT to 2026-10-23 16:16 PDT (services stopped). Cowrie from ~23:20 PDT on 10-14.
• Totals: 9,899,436 events (Cowrie 8,362,990, OpenCanary 1,534,137, pre-Cowrie snapshot 2,309); 428,996 Cowrie sessions (405,429 Telnet, 23,567 SSH); 1,417 Cowrie IPs and 3,284 OpenCanary IPs; 205,453 download attempts, 81 unique files.

Files

Decompress with zstd -d --long=27 FILE.zst.

Schema

canarydash-full.sqlite:

• events(id, ts, era, ip, logtype, port, usr, pwd, sess, raw): one row per log record. ts is Unix ms (UTC); era is cowrie, live opencanary or pre-cowrie snapshot; logtype is the OpenCanary logtype (Cowrie event ids are mapped to codes; see docs/GLOSSARY.md in the repo); raw is the original JSON record.
• geo(ip, info): offline DB-IP Lite country/ASN lookup (JSON).
• meta(k, v): precomputed summaries, the ingest report, admin actions and the malware listing.

explore.sqlite: table ev, one row per event with parsed fields (source, time, IP, protocol, event type, port, credentials, command, hash, URL, country, ASN, persona, session) and indexes.

License

Same as the GitHub repo (no license file was specified there).