29 unique payload SHA256 hashes captured. One campaign delivered the same binary from three different source IPs — coordinated infrastructure, not independent actors. Full report + analysis scripts + corporate honeyfs setup: github.com/dblanko/honeypot-analysis Full post: sshlab.eu/blog/what-52000-ssh-sessions-look-like-cowrie-honeypot-data-b4115c78 #honeypot #cowrie #infosec #ssh #threatintelligence