Investigation write-ups

Real events from my honeypot and an incident response case, documented the way I would hand them to another analyst: a verdict up front, then the evidence, the assessment, and what to do next.

ResolvedIncident Response

WordPress Compromise: Containment and Recovery

A site owner reported the site was "acting up." It was an active compromise through a vulnerable file-manager component. Contained, persistence removed, and back on a clean build in about 2.5 hours.

Dec 15, 2024 2 min read

MaliciousVoIP Security

A VoIP Toll-Fraud Probe on My Honeypot

A rented VPS sent SIP INVITEs to sequential premium-rate numbers behind a Cisco User-Agent. Toll-fraud reconnaissance: marked malicious and reported to AbuseIPDB.

Sep 22, 2025 2 min read

BenignThreat Intelligence

A Commercial Scanner Cataloging My Services

A clean handshake, a banner grab, and an immediate reset from ONYPHE, a commercial internet scanner. Closed as benign without a report, and still worth understanding.

Sep 24, 2025 2 min read

InconclusiveThreat Intelligence

A TLS Handshake on My Honeypot’s Management Port

Suricata flagged a completed TLS handshake against 64297/TCP, T-Pot’s own dashboard port. Inconclusive on intent, and a clear finding about my own configuration.

Sep 20, 2025 2 min read