CERT.br Projects

Distributed Honeypots

The objective of this project, maintaned by CERT.br, is to increase the capacity of incident detection, event correlation and trend analysis in the Brazilian Internet space. To achieve these goals the following is in place:

A network comprised of distributed low-interaction honeypots (Honeyd), covering a comprehensive portion of the Brazilian IP address space;
A system to notify CSIRTs (Computer Security Incident Response Teams) of networks that generate attacks against the honeypots;
Public statistics gerenated:
- Statistics for the network flow data directed to honeypots in the last 24 hours;
- Daily statistics for the network flow data directed to honeypots, data since January 2017;

SpamPots

In this project we use low-interaction honeypots to obtain details about the abuse of the Internet infrastructure by spammers.

In the first phase the focus was to study the abuse of broadband connected computers by spammers. There is a whitepaper (in Portuguese) with the results of this phase:

Resultados Preliminares do Projeto SpamPots: Uso de Honeypots de Baixa Interatividade na Obtenção de Métricas sobre o Abuso de Redes de Banda Larga para o Envio de Spam

In 2009 we started the international phase, with sensors in about 10 countries. The main focus is to study the differences and similarities of the Internet infrastructure abuse in different geografical locations.

$Date: 2022/03/16 19:17:47 $

Núcleo de Informação e Coordenação do Ponto BR

CERT.br Projects

Distributed Honeypots

SpamPots