Internet Storm Center
Training
Certification
Cyber Security Graduate School
Security Awareness Training
Computer Forensics
Penetration Testing
IT Audit
Software Security
Web Application Logs
In order ot participate and to submit your own logs, you need to first sign in. Next click on the "My Information" link. You should now see a section of the page titles "Web Logs". It includes a link to the current version of the honeypot. The compressed file includes installation instructions. Once you got it installed, return to this form and enter your honeypot's URL and identify it as active
In order to participate you need a web server running PHP. We are testing with Apache on Linux and Windows. You do not need to dedicate an IP address to the honeypot. A name virtual host will work just fine (make it the default one if you can). Your web server needs to be reachable to the public and your web server has to be able to post logs via http or https to our web server.
Results
Reports
See our reports summary page at isc.sans.edu/weblogs/reports.html for more reports.
Back to Index
Report Volume
This table summarized the report volume received over the last 10 days.
- Date: We use GMT as timezone for all of our date and time values.
- Reports: Individual reports. Each request to a honeypot is counted as a report. Some honeypots will supress related reports. For example, if a page includes images, only the request to the actual page is counted and the subsequent requests to images may be ignored.
- Submitters: Identified users submitting reports.
- Targets: Target hosts submitting data. This number may be larger then the number of submitters as some submitters operate mulitple honeypots.
- Sources: Distinct source IPs detected on a particular day.
Back to Index
Date Reports Submitters Targets Sources 2012-05-20 7822 2 2 154 2012-05-19 12942 2 2 176 2012-05-18 11645 2 2 145 2012-05-17 11166 2 2 142 2012-05-16 11930 2 2 141 2012-05-15 11632 2 2 139 2012-05-14 12103 2 2 144 2012-05-13 12077 2 2 148 2012-05-12 12727 2 2 154 2012-05-11 9580 2 2 145
Top Attacks
We try to classify attacks based. This system was created by STI masters candidate Eric Conrad as part of his software security requirement. Not all "hits" to a honeypot can easily be identified as "attacks", and some may actually just be begin. For example, a GET request for "/" could be recognicance or just a user or search engine stumbling across the site.
The attacks are "ranked" by the product of reports, targets and sources. The data is pulled from today.
- CVE: Common Vulnerability Enumeration identifier (see cve.mitre.org)
- OSVDB: Open Source Vulnerability Data Base identifier (see www.osvdb.org)
- Name: A description of the request.
Back to Index
Reports Authors Sources Name CVE OSVDB 10 1 6 robots.txt access
Top Attack Groups
Back to Index
Reports Authors Sources Group
