As cited
Copy frozen at (site build).
research
Looking for a Language [Guest Diary]
A SANS.edu intern analyzed honeypot web traffic in Elastic/Kibana to identify anomalous activity by examining HTTP Accept-Charset and Accept-Language headers. By filtering on uncommon header values indicating Chinese character set preferences, the analyst discovered 31 requests originating from Canadian autonomous system AS-7456 that systematically scanned multiple internet endpoints for common application paths like /config.json and /cgi-bin/login. The investigation revealed coordinated scanning activity from high-entropy domains operating from the same network prefix.
Why it matters: Security practitioners running web honeypots or network security information and event management (SIEM) deployments can adopt this feature engineering approach to efficiently narrow large datasets and detect automated scanning campaigns that would otherwise blend into baseline traffic noise.
- Source published
- First seen by Cybersecurity Tracker