HoneyLabs

Some IPs probe a CVE's exact exploit path weeks before it's public, and if you're recording, you can see it. On April 11 one of our honeypots logged 16 requests for the cPanel WHM login path on port 2087 from 85[.]122[.]114[.]177, an address that has never touched us otherwise, before or since. 17 days later cPanel disclosed CVE-2026-41940, a 9.8 auth bypass in exactly that flow. Method, formulas, and the live table: https://honeylabs.net/blog/probe-17-days-before-the-cve #ThreatIntel #ThreatHunting #Honeypots #CVE #InfoSec #DFIR

Added new tools! cve_lookup, top_attackers by=cve, and a better ioc_lookup. https://honeylabs.net/mcp

AI crawler impersonation is getting more prevalent these days. Here's a campaign of 26 hosts, scanning with 42,321 different Anthropic user-agents https://honeylabs.net/blog/spoofed-ai-crawlers-one-client

@hrbrmstr@mastodon.social Specialised local LLMs for honeypots seems like a really cool angle. Will be keeping an eye on them!

@hrbrmstr@mastodon.social Ah, I thought the site referenced using a local LLM. I wonder how they defend against injection attacks. Would be a wild way to priv esc a honeypot.