Hacker News Reader

I'm curious what would happen if someone set up a sandbox and let the attackers in. As in curious what commands they would run and what services they would try to install. I'm guessing crypto mining or spam mail?

The problem with a honey trap like that is that the uninteresting events are uninteresting (as you suggest, installing a mail relay, miner, or both, and likely a copy of itself for further spreading), but the interesting ones are unlikely to be fooled unless the honeypot is very clever.

To see anything really interesting you possibly need to let it get far enough that with a good zero-day intend in-hand it may be able to break out and affect the host. I don't know about you, but I don't trust myself to be that clever!

That's a wonderful project. Amazing, this can be done with just over a hundred lines of code. (excluding packages)

That looks gorgeous, thanks for sharing it!