Observed arrival · 2026-10-23
bogo’s honeypot field notes
A technical field journal documenting what automated scanners do when they meet decoy services on a small public machine.
- For
- Security researchers tracking internet-wide scanning
- Worth noticing
- The author identifies nine shuffled 98-path sweeps as one campaign, rather than nine independent visitors.
Field notes
The notes describe a throwaway internet-facing VM with eight decoy services, then compare what reached each bait port. One reported wordlist campaign hit nine hosts with the same 98 paths in different orders; the author distinguishes that repeated set from an earlier mistaken claim that the order matched. A separate Jenkins sequence includes repeated `/script` and `/whoAmI/api/json` hits and nine requests shaped like the Jenkins file-read exploit. The page says the machine is a $5/month Amsterdam VM with no keys or tailnet.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
One card from the complete issue