Honeypot Analysis Reveals China-Linked Scanning Network
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
SANS ISC diary uses Kibana field analysis on honeypot data to uncover an automated scanning campaign from AS-7456 using Chinese-language HTTP headers.
This SANS Internet Storm Center guest diary is primarily a methodology walkthrough demonstrating how to use Elastic Kibana's Field Statistics and long-tail/distribution analysis to triage large honeypot datasets (DShield SIEM, ~1 million records over 3 weeks). The author uses an unusual HTTP Accept-Charset header value (GBK, a Simplified Chinese character set) as a pivot point to isolate anomalous traffic from a much larger dataset, then further pivots on Accept-Language headers indicating Mainland Chinese preference (zh-CN) to identify a cluster of related scanning activity.
The analysis surfaces an automated scanning campaign originating from Canadian-registered Autonomous System AS-7456, despite the traffic consistently signaling Chinese language/character-set preferences. The scanning hosts repeatedly probe common endpoints such as /cgi-bin/login, /config.json, /sitemap.xml, /robots.txt, /favicon.ico, and the site root — consistent with reconnaissance/fingerprinting behavior rather than active exploitation. Several associated domains were identified as having high entropy or Chinese-language naming patterns, suggesting bot-driven scanning infrastructure. No specific vulnerability was exploited; the piece references a prior Fortinet FortiGate credential-compromise blog only as background on related honeypot rule categories (Fortinet Emulation), not as something exploited in this traffic.
For defenders, the primary value is methodological: using optional, often-overlooked HTTP headers (Accept-Charset, Accept-Language) as pivot fields in SIEM/Kibana long-tail analysis can help separate automated bot/scanner traffic from legitimate requests, even when source geolocation or ASN ownership appears benign. The listed IPs and domains represent low-sophistication, opportunistic internet-wide scanning infrastructure rather than a targeted intrusion.
Detection guidance
Web Reconnaissance Probe for cgi-bin Login and config.json Endpoints Returning Errors
Detects requests for /cgi-bin/login or /config.json that return 401/403/404, matching the opportunistic fingerprinting seen in the scanning cluster. Correlating several such requests from one source over time is recommended. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Reconnaissance Probe for cgi-bin Login and config.json Endpoints Returning
Errors
description: Detects web requests for device-login and configuration endpoints (/cgi-bin/login,
/config.json) that the server answers with 401/403/404. This matches the opportunistic
fingerprinting by an automated scanning cluster. Alert on repeated hits from one
source over a short window (threshold applied in the SIEM, not in this rule).
tags:
- attack.reconnaissance
- attack.t1595
logsource:
category: webserver
detection:
selection_uri:
cs-uri-stem|endswith:
- /cgi-bin/login
- /config.json
selection_status:
sc-status:
- 401
- 403
- 404
condition: selection_uri and selection_status
falsepositives:
- Legitimate single-page applications or monitoring probes that request /config.json
when the file is absent
- Authorised vulnerability scanners run by the internal security team
level: low
id: 989bd278-35fb-5ed4-9035-10ef97b9be45
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33442
2 more detections for this report are in the app — indicator rules, each with Sigma, Splunk SPL, Elastic, and Suricata. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://isc.sans.edu/diary/rss/33442
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators and its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply). The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 14,158 reports from 143 sources, 546 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs