Field notes from running honeypot sensors at scale.
2026-07-23
A single-purpose IP checked cPanel login path 17 days before the vendor advisory for CVE-2026-41940. How we measure pre-publication probing across 30M+ probes without fooling ourselves, and the three actors that survive the checks.
2026-07-20
Our honeypots run no industrial equipment, yet 2,661 hosts sent a real Modbus, DNP3, S7comm or IEC-104 handshake in five months. Decoding the payloads: which scanners, which PLCs they hunt, and how far each probe goes.
2026-07-12
Two HoneyLabs feeds were merged into MISP's default feed set in PR #10864: active exploiters and malware infrastructure. Every MISP instance can now pull them with no API key and no manual config. What they contain and how to enable them.
2026-07-10
In late June, 38 Google Cloud machines fired 1.87 million requests guessing the filenames of leaked database dumps. By IP and HTTP fingerprint they looked like 11,000 unrelated scanners; by TLS fingerprint they were a single operation. A field lesson in attributing coordinated cloud activity at the layer that actually holds.
2026-07-08
CVE-2026-34197 (KEV) probed by 421 IPs; port 33 lit up with 179,369 events. Most-hit ports, exploit paths to grep your logs for, and delivered malware. 2,710,022 events from 25,986 IPs, June 29 to July 5, 2026.
2026-06-24
Nobody's exploiting you. They're reading your .git/config.
2026-06-17
Almost every IP we logged exploiting the Gravity SMTP credential bug shares one HTTP fingerprint. Behind it is a Google Cloud fleet of thousands of short-lived instances, disguised by 3,299 rotating user-agents, sweeping more than 36,000 ports for .env files, git configs, credentials, and database dumps.
2026-06-04
Added header search to the lookup tool. One query over the forwarding headers turns up a localhost-bypass farm hunting .env files, Log4Shell still smuggled into X-Forwarded-For, and scanners leaking their own internal IPs.
2026-05-31
A client fingerprint is reused even as an operation rotates its IPs. Measuring how concentrated each fingerprint is across networks and ports turns a manual hunt into a live page. Among the thirteen it surfaces is the Viettel SSH botnet we mapped by hand earlier.
2026-05-29
A single attacking IP tells you little. The back end it pulls its payload from, and the client fingerprint it presents, are the parts operators reuse. Correlating both across the sensor network collapses internet noise into discrete operations: one cluster of 1,001 IPs across 306 networks and 64 countries, tied to eight shared staging servers and a single TLS and HTTP fingerprint that appears nowh
2026-05-28
Three weeks of one Dutch ASN sending 3,861 hits at Anthropic-proxy paths. Port 11434 (Ollama) holding 50-80 distinct source IPs per week since March. A single 45-minute sweep from one IP that lists credential paths for Claude, Codex, Gemini, DeepSeek, DashScope, AWS, Azure, Docker, and shell history.
2026-05-28
A short tour of what we run, what is in the dataset, and what we plan to write about here.
New research, by email
Get new HoneyLabs posts by email as they publish: research write-ups, plus threat reports on port movers, KEV and recent CVE probes, and the attack paths worth grepping your own logs for. Here is a recent threat report.
Double opt-in: we send one confirmation email and nothing else until you click it. Unsubscribe in one click, any time.