Lots of blog entries on this:
https://hackerfactor.com/blog/index.php?/archives/1022-Catching-Flies-with-Honey.html
https://hackerfactor.com/blog/index.php?/archives/997-No-NOC-Networking-Part-3.html
As far as setup: For this honeypot, I registered a new domain name (years ago), put up a minimal web site, and enabled tons of tracking and logging.
Since it's not advertised or mentioned anywhere, all the bots find it organically. (I haven't identified how Facebook found it.)
Hacker Factor /
npub1ju…sse9n
2024-09-06 15:32:06
in reply to nevent1q…jp3h
Author Public Key
npub1juzxwk54l455a96gh2ujty02wt3urjhht4q2uwzq8ctjvt26e88q7sse9nSeen on
wss://relay.momostr.pinkPublished at
2024-09-06 15:32:06Event JSON
{
"id": "d3e1fef51bcbc4b3c5e729e65cc10582079e5fcf14f797ec3b80a7addf906a74",
"pubkey": "9704675a95fd694e9748bab92591ea72e3c1caf75d40ae38403e17262d5ac9ce",
"created_at": 1725636726,
"kind": 1,
"tags": [
[
"p",
"9704675a95fd694e9748bab92591ea72e3c1caf75d40ae38403e17262d5ac9ce"
],
[
"e",
"58c25cc19a242b3b17ff83a7e1bd66c5d070e42cff195086fe9db1744f0aa981",
"",
"reply",
"320be230911f3f2a6812086735314cb538501e45a695efec02ecc41a58c2b20d"
],
[
"proxy",
"https://noc.social/@hackerfactor/113091328508620449",
"web"
],
[
"p",
"320be230911f3f2a6812086735314cb538501e45a695efec02ecc41a58c2b20d"
],
[
"e",
"c9bbada59a492a1434ac99a5e1b68f8823926fc92e09a79c40e9a9ffaf6f15ff",
"",
"root",
"9704675a95fd694e9748bab92591ea72e3c1caf75d40ae38403e17262d5ac9ce"
],
[
"proxy",
"https://noc.social/users/hackerfactor/statuses/113091328508620449",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://noc.social/users/hackerfactor/statuses/113091328508620449",
"pink.momostr"
],
[
"-"
]
],
"content": "Lots of blog entries on this:\nhttps://hackerfactor.com/blog/index.php?/archives/1022-Catching-Flies-with-Honey.html\n\nhttps://hackerfactor.com/blog/index.php?/archives/997-No-NOC-Networking-Part-3.html\n\nAs far as setup: For this honeypot, I registered a new domain name (years ago), put up a minimal web site, and enabled tons of tracking and logging.\n\nSince it's not advertised or mentioned anywhere, all the bots find it organically. (I haven't identified how Facebook found it.)",
"sig": "a545f0a4ed25af4d365280d8d85d968e40a7ef92c4bd7cf0c8aad23de7f32a3223bb01696cad4c80497b6b5093600c5bc36d949aee44c3fef8060af77f918b94"
}