blob: 2b9aae3d1e30fd61f215bb154a22c8a50f430c95 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
|
# HTTP URL Paths Observed (from prior week Honeylabs data)
/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- PHPUnit RCE probe
/dana-na/auth/url_default/welcome.cgi -- Pulse Secure VPN enumeration
/global-protect/login.esp -- Palo Alto GlobalProtect enumeration
/sslvpnLogin.html -- SSL VPN portal enumeration
/guacamole/ -- Apache Guacamole RDP gateway probing
/remote/login -- Generic remote access login probe
/auth/login -- Authentication endpoint probing
/login -- Login page enumeration
# Note: No URL paths were observed in Honeylabs events from monitored ASNs
# this week. All non-PFCLOUD ASNs registered zero honeypot events.
# PFCLOUD Honeylabs events were proxy-checking (HTTP CONNECT tunnels, SOCKS5)
# rather than HTTP path-based exploitation.
|
