HONEYPOT REPORT // 2026-08-05 – 2026-08-10

2026-08-05 – 2026-08-10 — Web Sensor Report

period 2026-08-05 – 2026-08-10
sensors Cowrie SSH/telnet + web deception panel
host VPS · containerized

WEB SENSOR OUTAGE BASELINE

Coverage. The SSH and telnet sensor produced no logs during this period. Three stacked defects — a non-ASCII character in a credential file that crashed the authentication handler on every attempt, a stale filesystem path, and a log directory the container could not write to — left it accepting connections and recording nothing. None threw an error visible without reading container logs. The outage ran six days and was found while preparing this report. Figures below are web sensor only.

WEB REQUESTS

4,115

6 days, external only

UNIQUE SOURCES

396

web sensor

PATH PROBES

3,692

90% of all traffic

EXPLOIT POSTS

no credential fields

SSH / TELNET

sensor down — see above

DECOY HITS

not yet deployed

Web sensor volume by day

1,186

08-05

283

08-06

796

08-07

464

08-08

987

08-09

399

08-10

Executive summary

This period is a baseline rather than a finding. The web panel presented a login form and nothing else, and the traffic that arrived was almost entirely automated path enumeration — 3,692 of 4,115 requests were probes for files that did not exist.

The value of recording it is comparative. Every request for /.env, /.git/config and their variants returned 404 during these six days. Forty such requests went unanswered. In the following period the same paths were made to return plausible content, and the difference in what that produced is the subject of the next report.

The demand is unambiguous and it is not for what the panel was offering. The single most requested path was /wp-admin/install.php, eighty-one times, from Cloudflare Worker egress addresses carrying the request URL in the User-Agent field — a scanner routing through a CDN to obscure its origin. Below that: a WordPress file-manager plugin, a webshell wordlist of roughly 180 filenames, and configuration files. Nothing asked for a NAS.

A deception panel is only as good as its match to demand. A well-built lure for a service nobody is looking for collects the same data as no lure at all.

Two hosts ran an identical webshell wordlist — mgrr.php, domvf.php, yj09.php, BDKR28WP.php, 3PJcpMFsD8B.php — seven and a half hours apart from different cloud providers. Those filenames are not installation attempts. They are lookups for shells already planted by somebody else: an operator hunting for access they did not have to earn.

Notable activity

2026-08-06 05:58 SHELL HUNTING 20.250.24.46 / 51.103.131.31

Two Microsoft Azure hosts running an identical ~180-entry webshell filename list, seven and a half hours apart, in the same order.

requests: 154 and 194 respectively
markers: this_is_a_new_hello_world.php, wp_filemanager.php, BDKR28WP.php
user-agent: none sent
assessment: searching for third-party webshells to inherit, not deploying their own

2026-08-05 → 08-10 CDN EGRESS Cloudflare Worker ranges

Repeated hourly requests for the WordPress installer, egressing through Cloudflare to hide the true source.

path: /wp-admin/install.php?step=1 (81 requests)
tell: the request URL is placed in the User-Agent header
accept-language: en-us,en;q=0.8,fr;q=0.5,fr-ca;q=0.3 — constant across all
note: a stable fingerprint despite rotating source addresses

2026-08-09 EXPLOIT SPRAY 3.23.60.56

Next.js React Server Components prototype-pollution payload POSTed at the login form, which is not a Next.js application.

gadget: __proto__.then reaching child_process.execSync
requests: 264
note: no fingerprinting performed — the payload was fired at every form on the host

What this period cost

Beyond the sensor outage, a second defect was found in the web tier. Requests arriving without a matching Host header were being closed silently rather than served. On 2026-08-10 alone that discarded 1,361 requests — 856 addressed to the bare IP, 408 with no Host header at all — against two requests it was intended to suppress.

Both faults share a shape worth naming: they produced clean logs and wrong data. No exception, no failed write, no alert. A log file that exists and is smaller than it should be looks exactly like a quiet week.

MITRE ATT&CK mapping

ID	technique	observed as
T1595.003	Active Scanning: Wordlist Scanning	3,692 path probes; a ~180-entry webshell filename list replayed by two hosts
T1592.002	Gather Victim Host Information: Software	WordPress, phpMyAdmin and plugin path enumeration against a host running none of them
T1190	Exploit Public-Facing Application	Next.js RSC prototype-pollution payload POSTed to a non-Next.js login form
T1552.001	Unsecured Credentials: Credentials In Files	Requests for `/.env`, `/.git/config`, `/.aws/credentials` — all unanswered this period
T1090.004	Proxy: Domain Fronting	WordPress installer probes egressing through Cloudflare Worker addresses
T1583.006	Acquire Infrastructure: Web Services	Scanning sourced from Azure and Google Cloud rather than dedicated hosting

cd .. next >>