What Is A Honeypot and How Does It Work?

Where are honeypot traps used?

Honeypot traps are used in a variety of ways and for different purposes. Some common honeypot traps include malware honeypots, spam traps, client honeypots, database honeypots, and honeynets.

Malware honeypots

Malware honeypots use known replication and attack vectors to invite malware attacks. For instance, malware honeypots can be used to emulate USB flash drives. If a machine is attacked by malware that infects USB drives, the honeypot will lure the malware into infecting the emulated USB drive. A team of experts can then analyze the malware to close vulnerabilities or create anti-malware software.

Spam honeypots

Spam honeypots are used to detect and block spammers who abuse open mail relays and open proxies. These servers accept mail indiscriminately and forward them to their destinations. Honeypot programs can be used to masquerade as such open mail relays and proxies to detect abuse from spammers.

Spam honeypots can reveal the IP address of the spammer, allowing the honeypot operator to block email messages from that address. The honeypot operator can also contact the ISP of the abuser to have their accounts canceled. Spam honeypots can be quite effective as they make spam abuse riskier and more difficult.

Database honeypot

A database honeypot is a decoy database set up to attract database-specific attacks such as SQL injection. Such attacks often slip by firewalls. Organizations use database firewalls that support honeypot systems to divert the attacker from the actual database.

Client honeypots

Client honeypots pose as clients and search for malicious servers that attack clients. These kinds of honeypots are used to observe how such malicious servers modify the client servers during attacks. They are typically run in virtualized environments.

Honeynet definition

A honeynet is a network of honeypots. Honeynets are designed to look like real networks and often contain multiple systems. They are used for monitoring large, complex networks where just one honeypot may be insufficient. 

In a honeynet, a “honeywall” gateway monitors the traffic coming into the network and leads it to the honeypot instances. The honeynet gathers information about the attackers while diverting them from the actual network. With the aid of a honeynet, different types of cybersecurity attacks, such as distributed denial of service (DDoS) attacks and ransomware attacks, can be studied. 

Honeynets are often implemented as part of a larger intrusion detection system. They are designed to contain all inbound and outbound traffic to protect the rest of the organization’s corporate network.

Honeypot traps and web scraping

In addition to the aforementioned applications of honeypots, websites use honeypot traps to detect and prevent malicious web scraping activity, e.g., theft of copyrighted content. Honeypot traps typically cannot distinguish good bots from malicious ones. Therefore, good web scraping bots that collect only publicly available data can be caught as well. 

Such honeypot traps are sometimes called spider honeypots. Web pages usually contain links that only web crawlers can access. When the crawler scrapes data from such links, the site immediately detects web scraping activity.

Beware of honeypot traps

It is essential to detect if a website uses honeypot traps because collecting public data from such websites is not advisable. Websites with honeypot traps can easily detect your web scraper and track your web scraping activity. In this case, they can take action against you, leading to being blocked and not getting the required public data.

You should know that some honeypot links, which are used to bait crawlers, have the CSS style of “display: none.” Others are disguised by having them blend in with the background color. It is crucial to ensure that your crawler only follows properly visible links. It is also important to follow web scraping best practices or use dedicated web scraping products to reduce your chances of getting blocked. You have to respect the rules of the website you intend to scrape data from.

Conclusion

Honeypot traps are effective techniques for detecting and thwarting malicious work from cybercriminals. However, they can pose a challenge for legitimate web scraping processes. If you are looking to only scrape public data for use cases like price monitoring, market research, and similar, you will have to watch out for spider honeypot traps and avoid them.

If you are interested in the data gathering process, we suggest you check out how to set the right approach to web scraping. Furthermore, if you are interested in other web scraping challenges, check out our article about CAPTCHAs or how HTTP cookies affect web scraping.