honeypot-tarpitslisted

# Honeypots and Tarpits A honeypot is a resource that exists only to be hit by attackers. Anyone who interacts with it is, by definition, doing something they should not be. That makes honeypots one of the highest-signal detection mechanisms available — almost zero false positives, and trivial to operate at small scale. This skill covers practical, low-effort patterns for solo operators and small teams. Not enterprise deception platforms (Thinkst Canary, etc., are excellent if you can afford them — but the same ideas work DIY). ## When to invoke - Public services see constant automated probing (fail2ban catches most but you want better signal) - You want detection without a full SIEM - Complementing existing WAF rules - After reconnaissance against a specific service (set traps for the next scan) - You want early warning if a credential leaked (canary tokens) ## Honeypot pattern 1 — fake admin paths Common scanner targets — `/wp-admin/`, `/administrator/`, `/manager/`, `/phpmyadmin/`, `/.git/config` — are reliable signals of automated probing. If you serve a real-looking 200 response and capture the source, you have an attacker IP/UA before they reach anything real. ```nginx # nginx — fake admin endpoint location ~ ^/(wp-admin|administrator|phpmyadmin|manager/html|.git/config|.env)$ { access_log /var/log/nginx/honeypot.log honeypot_fmt; add_header Content-Type text/plain; return 200 "OK"; # Looks fake, but the goal is the log entry, not realism } # Opti