Field notes from running honeypot sensors at scale.
2026-10-07
Over fifteen complete days in September and October, 32 short-lived Azure machines asked our honeypots for 1,197 specific PHP filenames, the names webshells get saved as, sending each name once as a bare GET with no User-Agent. The list is sharded across the nodes, 43 percent of it matches what SANS ISC logged from the same tooling in April, and the full list is here to grep a web root against.
2026-09-30
One visitor has sent the same two requests from 21,076 addresses in 32 weeks, and no fingerprint we had could say so. Akin is the open HTTP request fingerprint we built so the token itself says how many headers two clients differ by.
2026-09-23
Every handshake here came from a Go client that scanned one of our internet honeypots. Since Go 1.21 the toolchain takes its crypto/tls defaults from the go directive in go.mod, so each ClientHello carries the module's era rather than the compiler's. Measured with 36 lab builds against 6,954,270 such handshakes from 50,693 addresses: the share on a directive of 1.22 or older fell from 81 to 30 percent between March and May, only 4 percent of them send a Go user-agent, and a go 1.23 directive on a modern toolchain gets no post-quantum key exchange at all.
2026-09-19
Small organisations' mail servers, Postfix on CentOS 7 for the most part, spent 3 and 4 September scanning the internet for SSH. 583 hosts, 391 networks, one client fingerprint. What the scanner collects, who the machines are, why they were picked, and three checks if you run a mail server.
2026-09-08
The scanners spoofing AI crawler user-agents to hunt credentials turned out to be one HTTP client running on 25 addresses. On 25 August it switched from nine fixed strings to a generator that has produced 6,648 different spellings of Claude-User alone, which breaks every allow-list that matches on the name.
2026-07-23
A single-purpose IP checked cPanel login path 17 days before the vendor advisory for CVE-2026-41940. How we measure pre-publication probing across 30M+ probes without fooling ourselves, and the three actors that survive the checks.
2026-07-20
Our honeypots run no industrial equipment, yet 2,661 hosts sent a real Modbus, DNP3, S7comm or IEC-104 handshake in five months. Decoding the payloads: which scanners, which PLCs they hunt, and how far each probe goes.
2026-07-12
Two HoneyLabs feeds were merged into MISP's default feed set in PR #10864: active exploiters and malware infrastructure. Every MISP instance can now pull them with no API key and no manual config. What they contain and how to enable them.
2026-07-10
In late June, 38 Google Cloud machines fired 1.87 million requests guessing the filenames of leaked database dumps. By IP and HTTP fingerprint they looked like 11,000 unrelated scanners; by TLS fingerprint they were a single operation. A field lesson in attributing coordinated cloud activity at the layer that actually holds.
2026-07-08
CVE-2026-34197 (KEV) probed by 421 IPs; port 33 lit up with 179,369 events. Most-hit ports, exploit paths to grep your logs for, and delivered malware. 2,710,022 events from 25,986 IPs, June 29 to July 5, 2026.
2026-06-24
Nobody's exploiting you. They're reading your .git/config.
2026-06-17
Almost every IP we logged exploiting the Gravity SMTP credential bug shares one HTTP fingerprint. Behind it is a Google Cloud fleet of thousands of short-lived instances, disguised by 3,299 rotating user-agents, sweeping more than 36,000 ports for .env files, git configs, credentials, and database dumps.
2026-06-04
Added header search to the lookup tool. One query over the forwarding headers turns up a localhost-bypass farm hunting .env files, Log4Shell still smuggled into X-Forwarded-For, and scanners leaking their own internal IPs.
2026-05-31
A client fingerprint is reused even as an operation rotates its IPs. Measuring how concentrated each fingerprint is across networks and ports turns a manual hunt into a live page. Among the thirteen it surfaces is the Viettel SSH botnet we mapped by hand earlier.
2026-05-29
A single attacking IP tells you little. The back end it pulls its payload from, and the client fingerprint it presents, are the parts operators reuse. Correlating both across the sensor network collapses internet noise into discrete operations: one cluster of 1,001 IPs across 306 networks and 64 countries, tied to eight shared staging servers and a single TLS and HTTP fingerprint that appears nowh
2026-05-28
Three weeks of one Dutch ASN sending 3,861 hits at Anthropic-proxy paths. Port 11434 (Ollama) holding 50-80 distinct source IPs per week since March. A single 45-minute sweep from one IP that lists credential paths for Claude, Codex, Gemini, DeepSeek, DashScope, AWS, Azure, Docker, and shell history.
2026-05-28
A short tour of what we run, what is in the dataset, and what we plan to write about here.
New research, by email
Get new HoneyLabs posts by email as they publish: research write-ups, plus threat reports on port movers, KEV and recent CVE probes, and the attack paths worth grepping your own logs for. Here is a recent threat report.
Double opt-in: we send one confirmation email and nothing else until you click it. Unsubscribe in one click, any time.