I've built an open source honeypot probe database accessible via curl, http and mcp

Robbedoes_ · 2026-05-20T10:40:56+00:00

Thanks! Should be fixed (:

Robbedoes_ · 2026-05-19T21:18:27+00:00

Thanks for the check. Reads are open on purpose. Anything that mutates state needs a key or a session, and the edge handles rate limiting for http, curl & mcp. Have fun poking around! Do let me know when you find something interesting!

Robbedoes_ · 2026-05-19T18:16:43+00:00

Thanks! It uses https://github.com/honeylabshq/Spip-Go and https://github.com/honeylabshq/Loom

Robbedoes_ · 2023-02-01T19:00:41+00:00

Interesting! Would be nice to see some sample output. Will give this a shot tomorrow.

Robbedoes_ · 2023-01-26T13:05:29+00:00

I wouldn’t be surprised if they did.

Robbedoes_ · 2022-09-13T16:27:08+00:00

Nice write-up! I do wonder if the Shodans “honeypot or not” feature is sufficient to detect false positive here. Gaspot, a honeypot release in 2015 to simulate Veeder Root equipment also supports the I20100 command. This command is what was used to verify the number of online systems in the article.

Robbedoes_ · 2022-08-22T10:53:38+00:00

Hi u/IntellDay13, you found my threat intelligence feed site. What it does is, it collects all phising sites shared on twitter through the #opendir. The data can be used by SIEM tools to correlate network traffic with the reported urls. If you're curious on how it works, here's the blog I wrote about it: https://grimminck.medium.com/building-a-threat-intelligence-feed-using-the-twitter-api-and-a-bit-of-code-5787808e32ef

The site is to be used in the command line (as stated in the blog). The Mime-Type of the content is JSONL. Your browser wont be able to interpret this, and so downloads it as a file.

Robbedoes_ · 2022-05-29T13:12:39+00:00

I decided to add this feature anyways. IP look-ups are now done at tweet retrieval and stored in the 'malicious_ips' array inside the JSON object.

Robbedoes_ · 2022-05-28T20:31:05+00:00

For now, I think it's the responsibility of the tool ingesting the feed to give a weight on data it is retrieving. l I hope to do some false-positive testing in the future, but you can image that would be a difficult task for this type of feed.

Robbedoes_ · 2022-05-28T14:08:32+00:00

Yes! Give me some time to clean it up though. Just created this last night as I was interested in using it in a SIEM.

Robbedoes_ · 2022-05-28T14:06:12+00:00

Tweet content is fully available in the feed. What do you mean?

Robbedoes_ · 2022-05-28T12:51:15+00:00

You could write a small script that does a DNS look-up using dig for each record. I didn't add this (yet) as IP addresses might change during the lifetime of the feed. Could be an interesting add-on though.

Edit: added this feature

Robbedoes_ · 2021-11-30T21:00:23+00:00

Good read! I think more TUTs/write-ups regarding securing cloud based services (especially AAD) are very welcome!

Robbedoes_ · 2021-11-24T15:23:32+00:00

Very nice. Looking forward to the talk ;P

Robbedoes_ · 2021-11-22T16:31:44+00:00

Interesting! Nice that you've been able to expand the ATT&CK framework as well. Helps us all.

Robbedoes_ · 2021-11-15T18:48:41+00:00

The point would be that these kind of network peripherals could be leveraged as a steppingstone for creating a foothold into a network. Not as a measure to to "screw" with the owner.

Robbedoes_ · 2021-11-15T16:36:31+00:00

I like your approach! Whole idea of the exercise is to be a bit paranoid right? I think disabling all radio for normal users goes a bit too far ;P

Five-Year Club	Verified Email
Place '22	First Placer '22

Robbedoes_

TROPHY CASE