diff --git a/tools/dashboard.php b/tools/dashboard.php index 235e012..0bd8b61 100644 --- a/tools/dashboard.php +++ b/tools/dashboard.php @@ -49,12 +49,16 @@ $countries = []; $hours = []; $creds = []; $ip_details = []; +$last_event_time = ''; +$attack_types = ['login' => 0, 'recon' => 0]; foreach ($entries as $e) { if (($e['type'] ?? '') === 'recon') { $total_recon++; + $attack_types['recon']++; } else { $total_attempts += ($e['attempt'] ?? 0) > 0 ? 1 : 0; + $attack_types['login']++; } $ip = $e['ip'] ?? '?'; @@ -90,6 +94,7 @@ foreach ($entries as $e) { } $ip_details[$ip]['attempts']++; $ip_details[$ip]['last'] = $e['timestamp'] ?? ''; + $last_event_time = $e['timestamp'] ?? $last_event_time; } arsort($usernames); @@ -102,6 +107,23 @@ $unique_ips = count($ips); $top_user = $usernames ? array_key_first($usernames) : '-'; $top_pass = $passwords ? array_key_first($passwords) : '-'; +// Threat level +$threat_level = 'NOMINAL'; +$threat_class = 'nominal'; +if ($total_attempts > 100) { $threat_level = 'ELEVATED'; $threat_class = 'elevated'; } +if ($total_attempts > 500) { $threat_level = 'HIGH'; $threat_class = 'high'; } +if ($total_attempts > 2000) { $threat_level = 'CRITICAL'; $threat_class = 'critical'; } + +// Time since last event +$last_ago = '-'; +if ($last_event_time) { + $diff = time() - strtotime($last_event_time); + if ($diff < 60) $last_ago = $diff . 's ago'; + elseif ($diff < 3600) $last_ago = floor($diff/60) . 'm ago'; + elseif ($diff < 86400) $last_ago = floor($diff/3600) . 'h ago'; + else $last_ago = floor($diff/86400) . 'd ago'; +} + // Active tab $tab = $_GET['tab'] ?? 'overview'; ?> @@ -111,61 +133,636 @@ $tab = $_GET['tab'] ?? 'overview'; -Honeypot Intel — <?php echo htmlspecialchars($site_name); ?> +THREAT INTEL // <?php echo htmlspecialchars($site_name); ?>
-

Honeypot Intelligence

-

— log entries

+ +
+
+
+
+
Threat Intelligence
+
// HONEYPOT COMMAND
+
+
+
+
+
ENTRIES
+
LAST EVENT
+
+
+ +
+
+
+
-
Login Attempts
-
Recon Visits
-
Unique IPs
-
Countries
+
+
Login Attempts
+
+
+
+
+
Recon Probes
+
+
Scan / enumeration
+
+
+
Unique Sources
+
+
Distinct IP addresses
+
+
+
Countries
+
+
Geographic origins
+
+
+
Credentials
+
+
Unique pairs captured
+
+ 'Overview','creds'=>'Credentials','passwords'=>'Passwords','usernames'=>'Usernames','ips'=>'IPs','countries'=>'Countries','timeline'=>'Timeline']; +$tabs = [ + 'overview' => 'Overview', + 'creds' => 'Credentials', + 'passwords' => 'Passwords', + 'usernames' => 'Usernames', + 'ips' => 'Sources', + 'countries' => 'GeoINT', + 'timeline' => 'Timeline', +]; ?> + + -
-

Top 10 Usernames

+
+ + +
+
+
Target Usernames
+
unique
+
+
- +
UsernameAttempts
+ $c): ?> - + + + + +
UsernameHitsDistribution
-
No login attempts yet
+
Awaiting threat data
+
-
-

Top 10 Passwords

+ +
+
+
Captured Passwords
+
unique
+
+
- +
PasswordAttempts
+ $c): ?> - + + + + +
PasswordHitsDistribution
-
No login attempts yet
+
Awaiting threat data
+
+
+ +
+ + +
+
+
Recent Activity
+
Last credential captures
+
+
+ +
+
+
+
+ +
+
→
+
+
+ # + +s +
+
+
Awaiting threat data
+
-
-

All Credential Pairs (newest first)

-
+
+
+
Credential Intercepts
+
pairs captured
+
+
+
- +
TimeIPCCUsernamePassword#Delay
+ - - - - - - - + + + + + + +
TimestampSource IPOriginUsernamePasswordAttemptTarpit
+s#+s
-
No credentials captured yet
-
+
No credentials intercepted
+
+
-
-

All Passwords by Frequency

-
+
+
+
Password Intelligence
+
unique passwords
+
+
+
- +
PasswordCount
+ $c): ?> - + + + + +
PasswordFrequencyDistribution
-
No passwords yet
-
+
No passwords captured
+
+
-
-

All Usernames by Frequency

-
+
+
+
Username Enumeration
+
unique usernames
+
+
+
- +
UsernameCount
+ $c): ?> - + + + + +
UsernameFrequencyDistribution
-
No usernames yet
-
+
No usernames captured
+
+
-
-

Attacking IPs

-
+
+
+
Threat Sources
+
unique IPs
+
+
+
- +
IPCountryHitsFirst SeenLast Seen
+ $c): $d = $ip_details[$ip] ?? []; ?> - - - - - - + + + + + +
Source IPOriginHitsFirst ContactLast ContactActivity
-
No IPs yet
-
+
No threat sources identified
+
+
-
-

Attacks by Country

+
+
+
Geographic Intelligence
+
countries identified
+
+
- +
CountryAttempts
+ $c): ?> - + + + + +
Country CodeEventsDistribution
-
No country data (requires Cloudflare)
+
No geographic data // requires Cloudflare headers
+
-
-

Attack Timeline (by hour)

-
+
+
+
Attack Timeline
+
Hourly event distribution
+
+
+
- +
HourEvents
+ $c): ?> - + + + + +
Hour (UTC)EventsActivity
-
No timeline data yet
-
+
No temporal data collected
+
+
-

wp-honeypot dashboard ·

+ +
+
+
+ TRAP ACTIVE // MONITORING +
+
+ wp-honeypot // +
+
diff --git a/trap/wp-trap.php b/trap/wp-trap.php index 69cafdc..eb62bad 100644 --- a/trap/wp-trap.php +++ b/trap/wp-trap.php @@ -9,7 +9,6 @@ * Real login is at the custom WPS Hide Login slug (or similar). * * Configuration: edit wp-trap-config.php alongside this file. - * Project: https://gitea.cloudforest-basilisk.ts.net/Arcnode.xyz/wp-honeypot */ // --- Load configuration ---