cowrie

A medium-to-high interaction SSH and Telnet honeypot that logs brute-force attacks and attacker shell sessions. It emulates a UNIX system or proxies to real hosts, and can optionally use an LLM to generate responses.