Possibility to report scammer IPs to abuseipdb

[V01D-PH03N1X]

Possibility to report scammer IPs to abuseipdb

[bn-s]

Hi DarkModz.

Both of the features you describe exist in the output (plugins) directory here.

Now, I can't speak for the VirusTotal plugin (I've never used it). But I can help you with the AbuseIPDB plugin.

Briefly, the way the plugin works is it listens for cowrie.login events and reports any IP that triggers that event. It will either report the IP immediately on the first attempt, or after n number of attempts. The latter part of this behaviour (report immediately or after n attempts) is user-configurable.

A good place to start for more information would be here. If that doesn't help, I'll try and answer any questions you might have.

Alternatively, if you were already aware of these plugins and are looking for extended functionality, could you specify what exactly you're looking for when you say "scammers who fell for the honeypot".

[micheloosterhof]

Both of these exist already! Please investigate the output plugins,
closing this ticket.