Back

TFTP Honey Pot Results

10 points1 hourbruceediger.com
vivi_10 minutes ago

I love investigating internet background radiation, this is interesting research. I've definitely seen spa504g.cfg (IP Phone) and spa112.cfg (Cisco analog terminal adapter) before; you should actually serve these a proper config file and spin up a disposable SIP server so you can (potentially) call them on the phone, send them a fax or even better ATDT ;)

Though, come to think of it these requests are more likely from credential harvesting bots as most ITSP's provision their CPE with a <macaddr>.cfg or similar.

nubinetwork23 minutes ago

50 packets a day is peanuts, I think the lowest ranking service group that I track is printers, and even that's around ~200 unique ips per day.