8 days ago
- 80-90% of honeypot hits originate from IP addresses not on existing threat monitoring lists, indicating widespread unknown malicious traffic.
- Global distribution of flagged IP addresses spans 229 countries, with high rates in countries like Bangladesh (29.9%) and Ukraine (27.6%), showing this is a worldwide issue.
- Compromised smart appliances likely contribute to proxy networks, driving much of this traffic, and addressing it requires global coordinated action.
- Anubis' honeypot feature uses deceptive HTML links to trap poorly written scrapers, collecting data on the prevalence of scraping activities.
- Top providers of flagged IPs include netshield (83.2%) and bitwire (33.7%), with abuse being the dominant category (98.6%) among flagged addresses.
- Web application firewalls like Anubis are justified as the scraping problem is extensive, affecting diverse ASNs and regions.