numnet.eu

Abuse reports from a passive honeypot

This domain belongs to Ákos Lukács, a Linux systems engineer in Szeged, Hungary, with an interest in security. If you received mail from abuse@numnet.eu, a host on your network connected to a passive honeypot that runs no real services and is not advertised anywhere. Every connection to it is therefore unsolicited. Each report was reviewed by a person before it was sent, and replies are read by a person too.

What this is

The honeypot listens on 217.13.111.95 (vps.numnet.hu) and on the parked domains it serves: cyberzone.hu, lukacsakos.eu, kelet.eu, numnet.hu and a few others. It runs no real services and only records what connects to it.

It never scans, attacks or probes anyone. It only listens and answers.

Some reports concern stolen credentials. The honeypot exposes decoy secrets (for example a decoy AWS key issued through Canarytokens). When one of them is used somewhere else, the network it was used from receives a report with the exact API call, the time and the user agent.

Public, anonymised statistics from the same honeypot are published at cyberzone.hu: live counters, a weekly summary and open data.

What a report contains

Passwords that attackers tried are never sent.

Replying

Replies to abuse@numnet.eu are read by a human. Each report carries a ticket number in the subject, in the form [numnet #123]. Please keep it when you reply, so your answer lands on the right ticket.

If you think a report is wrong, reply and say so; it will be looked at. False positives get corrected.

Contact