Honeypot on the boykisser forum
A forum operator used a phpBB honeypot and Fail2Ban to ban and report suspected scraper-botnet IPs.
A phpBB forum operator deployed a hidden-link honeypot that appends Apache deny rules and logs a fake HTTP 500. A custom Fail2Ban filter and jail, with maxretry set to 1, bans those IPs and reports them to AbuseIPDB and Sniff-cat. The author says many hits share session IDs, target only known forum URLs, and use Chromium user agents around versions 145–150, and speculates a residential botnet is scraping sites to train language models. No malware family, CVE, or independent confirmation is provided.
- Hidden phpBB link writes deny rules and returns a fake HTTP 500.
- Fail2Ban jail bans an IP on the first honeypot hit.
- Those residential IPs are reported to AbuseIPDB and Sniff-cat.
- Author suspects a scraper botnet harvesting text to train LLMs.
- Blocking Chromium user agents below version 150 reduced hits.
- Countries
- Germany
From the original article
3 min read at blog.boykisser.nl
A while ago i setted up an honeypot to combat the huge botnet i was experiencing this may. I setted up an honeypot after an recommendation over on the phpBB community forums. What is noticable about this “botnet” though, is that all these IP seems to come from third-world countries.
By blog.boykisser.nl via FedericoSchonborn · blog.boykisser.nl
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.