# Honeypot Analysis Reveals China-Linked Scanning Network

Published: 2026-10-26 · Severity: routine
Canonical: https://vorant.io/reports/1e1d6a6e-ac71-5608-a44f-5536db68e3f1/honeypot-analysis-reveals-china-linked-scanning-network

> SANS ISC diary uses Kibana field analysis on honeypot data to uncover an automated scanning campaign from AS-7456 using Chinese-language HTTP headers.

This SANS Internet Storm Center guest diary is primarily a methodology walkthrough demonstrating how to use Elastic Kibana's Field Statistics and long-tail/distribution analysis to triage large honeypot datasets (DShield SIEM, ~1 million records over 3 weeks). The author uses an unusual HTTP Accept-Charset header value (GBK, a Simplified Chinese character set) as a pivot point to isolate anomalous traffic from a much larger dataset, then further pivots on Accept-Language headers indicating Mainland Chinese preference (zh-CN) to identify a cluster of related scanning activity.

The analysis surfaces an automated scanning campaign originating from Canadian-registered Autonomous System AS-7456, despite the traffic consistently signaling Chinese language/character-set preferences. The scanning hosts repeatedly probe common endpoints such as /cgi-bin/login, /config.json, /sitemap.xml, /robots.txt, /favicon.ico, and the site root — consistent with reconnaissance/fingerprinting behavior rather than active exploitation. Several associated domains were identified as having high entropy or Chinese-language naming patterns, suggesting bot-driven scanning infrastructure. No specific vulnerability was exploited; the piece references a prior Fortinet FortiGate credential-compromise blog only as background on related honeypot rule categories (Fortinet Emulation), not as something exploited in this traffic.

For defenders, the primary value is methodological: using optional, often-overlooked HTTP headers (Accept-Charset, Accept-Language) as pivot fields in SIEM/Kibana long-tail analysis can help separate automated bot/scanner traffic from legitimate requests, even when source geolocation or ASN ownership appears benign. The listed IPs and domains represent low-sophistication, opportunistic internet-wide scanning infrastructure rather than a targeted intrusion.

## Detection guidance (public sample)

### Web Reconnaissance Probe for cgi-bin Login and config.json Endpoints Returning Errors

ATT&CK: T1595

Detects requests for /cgi-bin/login or /config.json that return 401/403/404, matching the opportunistic fingerprinting seen in the scanning cluster. Correlating several such requests from one source over time is recommended. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Reconnaissance Probe for cgi-bin Login and config.json Endpoints Returning
  Errors
description: Detects web requests for device-login and configuration endpoints (/cgi-bin/login,
  /config.json) that the server answers with 401/403/404. This matches the opportunistic
  fingerprinting by an automated scanning cluster. Alert on repeated hits from one
  source over a short window (threshold applied in the SIEM, not in this rule).
tags:
- attack.reconnaissance
- attack.t1595
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|endswith:
    - /cgi-bin/login
    - /config.json
  selection_status:
    sc-status:
    - 401
    - 403
    - 404
  condition: selection_uri and selection_status
falsepositives:
- Legitimate single-page applications or monitoring probes that request /config.json
  when the file is absent
- Authorised vulnerability scanners run by the internal security team
level: low
id: 989bd278-35fb-5ed4-9035-10ef97b9be45
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33442
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

2 more detections for this report are in the app: indicator rules, each with Sigma, Splunk SPL, Elastic, and Suricata. A free account opens them.

Source reporting: https://isc.sans.edu/diary/rss/33442

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/1e1d6a6e-ac71-5608-a44f-5536db68e3f1/honeypot-analysis-reveals-china-linked-scanning-network.
In the app the same report carries its extracted indicators and its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply). The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup