# HTTP URL Paths Observed (from prior week Honeylabs data)

/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php  -- PHPUnit RCE probe
/dana-na/auth/url_default/welcome.cgi  -- Pulse Secure VPN enumeration
/global-protect/login.esp  -- Palo Alto GlobalProtect enumeration
/sslvpnLogin.html  -- SSL VPN portal enumeration
/guacamole/  -- Apache Guacamole RDP gateway probing
/remote/login  -- Generic remote access login probe
/auth/login  -- Authentication endpoint probing
/login  -- Login page enumeration

# Note: No URL paths were observed in Honeylabs events from monitored ASNs
# this week. All non-PFCLOUD ASNs registered zero honeypot events.
# PFCLOUD Honeylabs events were proxy-checking (HTTP CONNECT tunnels, SOCKS5)
# rather than HTTP path-based exploitation.