djkurlander

Yes. And in retirement, I still code because I like the process of creating (hopefully cool) things. Even without remuneration. Ideally things that other people will use and benefit from in some way.

Nothing wrong with contacting the customer, and taking down the IP briefly until the customer can deal with their malware hosting toaster.

However, I can see the argument for giving the customer 24-48 hours to resolve the problem.

Crafted that awesome response to your original query myself, and I am very human.

Good question. You can certainly proxy SIP. But what’s notable here is that the traffic comes directly from organizations that should be secure: banks, infrastructure, governments. For a proxy to explain it, the proxy exit node would have to be running inside those institutions, on their networks. So from a security standpoint it doesn’t really matter whether a botnet is running inside the company or the company is being used as a proxy hop. Either way, a machine on their network has been compromised.

(And your P.S. is spot on. The attacker bears none of the cost; the clean IP reputation and the blame land on the compromised third party.)

Much appreciated! Trying to help out the community with the honeypot & API, and it's always fascinating what attack patterns show up.

As mentioned above, wrote the blog post myself and had AI proofread and edit. As for the honeypot itself, I'm a greybeard computer scientist, and I architected the system very deliberately myself, using AI as a coding accelerator. Earlier in my career, moving from Assembly to C, I certainly appreciated the convenience of a higher level language. Same from C to C++ to Java/Lisp/Python to LLM. It's always a march to higher level languages and letting the computer do more work.

Wrote the blog post myself, and used AI to clear up typos and occasionally improve wording. I have a PhD in computer science, but I was initially planning to pursue journalism instead, so I like to think that I can write good :-).

Ha! Love it. Totally believe in it too.

The actual blog post clarifies this as well. But still in some sense these organizations share some level of responsibility if it is their machines, attacking from their ASN.

Yes - I would have expected better from these institutions as well, but there's always going to be someone who brings their rogue laptop onto the corporate net. The key is how fast the security catches it. They can use the api that I describe in the blog to check my honeypot for their IPs. Very simple to put into a daily or hourly script.