Honeypot on the boykisser forum

A while ago, the reporter set up a honeypot to combat a large botnet they were experiencing. The honeypot was recommended on the phpBB community forums. An interesting aspect of this botnet was that the majority of IP addresses came from third-world countries, although some did originate from normal countries, including one from Germany.

The botnet was also targeting specific parts of the website, such as a forum, instead of the main site. Additionally, multiple IP addresses shared the same SID of the forum, which raised suspicions of malicious activity.

The reporter left the honeypot unattended initially. Once triggered by a hidden link, the honeypot added a "deny from" in the forums' .htaccess file and displayed a fake 500 internal server error. This approach was found to be somewhat ineffective if initiated unknowingly by an infected machine. The honeypot URL also received a unique ID.

The reporter noticed that any honeypot URL generated an error in the server's log file, which could be used by Fail2Ban to ban IP addresses. The reporter created a filter called "phpbbhp" and a corresponding jail in Fail2Ban, setting the "Maxretry" to 1 to ban IPs immediately upon detection in the honeypot. The reports were marked as "exploited host" and were directed towards reporting the IP addresses on AbuseIPDB and SniffCat, two platforms for tracking abusive IP addresses.

The reporter believes these residential IP addresses are part of a large botnet controlled by a Command and Control server, likely scraping data from the targeted website. The honeypot was effective in identifying and blocking malicious connections. The reporter also observed that most bots used a Chromium browser version between 145 and 150, and instructed users to block lower versions, which proved effective.