honeypot-tarpits

Honeypots and Tarpits

A honeypot is a resource that exists only to be hit by attackers. Anyone who interacts with it is, by definition, doing something they should not be. That makes honeypots one of the highest-signal detection mechanisms available — almost zero false positives, and trivial to operate at small scale.

This skill covers practical, low-effort patterns for solo operators and small teams. Not enterprise deception platforms (Thinkst Canary, etc., are excellent if you can afford them — but the same ideas work DIY).

When to invoke

• Public services see constant automated probing (fail2ban catches most but you want better signal)
• You want detection without a full SIEM
• Complementing existing WAF rules
• After reconnaissance against a specific service (set traps for the next scan)
• You want early warning if a credential leaked (canary tokens)

Honeypot pattern 1 — fake admin paths

Common scanner targets — /wp-admin/, /administrator/, /manager/, /phpmyadmin/, /.git/config — are reliable signals of automated probing. If you serve a real-looking 200 response and capture the source, you have an attacker IP/UA before they reach anything real.

# nginx — fake admin endpoint
location ~ ^/(wp-admin|administrator|phpmyadmin|manager/html|.git/config|.env)$ {
    access_log /var/log/nginx/honeypot.log honeypot_fmt;
    add_header Content-Type text/plain;
    return 200 "OK";    # Looks fake, but the goal is the log entry, not realism
}

# Optional: in a separate http block, structured logging
log_format honeypot_fmt escape=json '{'
  '"time":"$time_iso8601",'
  '"ip":"$remote_addr",'
  '"path":"$request_uri",'
  '"method":"$request_method",'
  '"ua":"$http_user_agent",'
  '"referer":"$http_referer"'
'}';

Pipe /var/log/nginx/honeypot.log to your alerting (Loki + Grafana alert, Better Stack, a tiny daemon that pings a webhook). Every hit is an attacker.

Optional escalation: feed honeypot-hit IPs straight to fail2ban or Cloudflare WAF block.