Honeypot on the boykisser forum
A forum operator used a phpBB honeypot and Fail2Ban to ban and report suspected scraper-botnet IPs.
A phpBB forum operator deployed a hidden-link honeypot that appends Apache deny rules and logs a fake HTTP 500. A custom Fail2Ban filter and jail, with maxretry set to 1, bans those IPs and reports them to AbuseIPDB and Sniff-cat. The author says many hits share session IDs, target only known forum URLs, and use Chromium user agents around versions 145–150, and speculates a residential botnet is scraping sites to train language models. No malware family, CVE, or independent confirmation is provided.
- Hidden phpBB link writes deny rules and returns a fake HTTP 500.
- Fail2Ban jail bans an IP on the first honeypot hit.
- Those residential IPs are reported to AbuseIPDB and Sniff-cat.
- Author suspects a scraper botnet harvesting text to train LLMs.
- Blocking Chromium user agents below version 150 reduced hits.
Full article790 words · extracted from blog.boykisser.nl · click to collapse
A while ago i setted up an honeypot to combat the huge botnet i was experiencing this may. I setted up an honeypot after an recommendation over on the phpBB community forums.
What is noticable about this “botnet” though, is that all these IP seems to come from third-world countries. But there are some that are coming from normal countries, i even observed a request from Germany.
Other thing i noticed is that they what seems to have an list of URL from my website, since they only hit a sudden part of (in this case) my forum, and only that. They dont even hit the main part of my website, or in this case the root of my forum. And what i also noitice is that no less than two different IP share the same SID of my forum. So i know somehting fishy is going on.
This includes the unique honeypot ID.
I setted it up as is, and didnt look back at it.
The honeypot
The honeypot is somewhat primitive if you look at it. Once triggerd by an hidden link, it adds a “deny from” in the forums htaccess file, and throws and fake 500 internal server error informing the user their IP got banned. Its kinda useless if it was initiated unknowingly, by an infected machine, and to some server (including mine) configuration it will just show a white screen.
And also any honeypot URL gets an unique ID attached to it.
Fail2Ban
But what did intrigue me, is the fact that it throws an error, in the error log of my server. And you know who can ban IP’s by loking at log files, thats right Fail2Ban. So i did. Including reporting
First i created a filter called “phpbbhp” in which i had to actually create an regex to match the error message the honeypot generated. I then validated the regex by using “fail2ban-regex” to look at the errorlog, and compare it to my regex. It failed multiple times. But after some intense use of a search engine, trail and error. I finally got it to work.
I than setted up an jail, and set the “Maxretry” to 1, so the IP’s will get hit with the banhammer the moment they fall into the honeypot. But still serve the page.
I also mark my reports under the “exploited host” category, since these connections are all coming from residential IP’s
I also instructed to report said IP’s to AbuseIPDB, and sniffcat aswell. The last one a alternative version of said blacklist.
Sniff-cat
Sniff-cat is a relatively newish blacklist aside from abuseIPDB, created by Sefinek. It has a more modern look, and feel compared to AbuseIPDB. But the idea is still the same. You can essentially help webmasters define if an IP address is really abusive, or not.
I will probably make a post abuseIPDB soon or later explaining the whole idea behind it
Success, and responsibilities
I’ve setted up the filter, and jail yesterday. And i can say the reports are flying in.
Are these reports justified? Somehow yes.
A honeypot is essentially bait to an restricted part of your website. Benign users will A) not even be aware you have one, and B) connections that will access your honeypot most likely have malicious intents. Or is an rogue bot.
And if you get an internet connection, you are essentially fully responsible for what happens on your connection. You are expected to regularly scan you devices for malware and such.
And if you happen to share your connection with your neighbor, you are also responsible for what your neighbor does on essentially your connection!
My ISP clearly states this in their terms of use.
So yes. These reports are justified on that part, since they are on their behalf.
Final thoughts
I’m 100% confident that these residential connections are part of an huge botnet, and controlled by and Command and Control server, that supplies an list of URLs to scrape.
I’ve noticed the same thing by a lot forum forums i regular visit, but cannot verify this since I’m unable to see the IP, and User-Agent.
I’ve blocked this since i also have an huge suspicion that this botnet is used to feed some sort of LLM. Essentially an unethical way to train AI.
Say i with me: AI BAD!!!
What i also noticed is that they al report to be a Chromium browser version around 145 to 150. So i blocked everything lower than version 150. And this seems to be very effective. But i noticed that Firefox is also being used, but only observed it banging its head to the honeypot.
For the time being, grab your popcorn, and observe my abuseIPDB profile.