Hacker News Reader

in this case: check if a directory /home/honssh exists to detect that it's a honeypot?

I think this would not work because the HonSSH server with the HonSSH user is hosting a proxy service. The user gets dumped into an actual vanilla looking Linux host at the backend.

Reply on news.ycombinator.com