TFTP Honey Pot Results

Re:TFTP Honey Pot Results by vivi_ on Monday July 13, 2026 @04:09PM (#48898104)

I love investigating internet background radiation, this is interesting research. I've definitely seen spa504g.cfg (IP Phone) and spa112.cfg (Cisco analog terminal adapter) before; you should actually serve these a proper config file and spin up a disposable SIP server so you can (potentially) call them on the phone, send them a fax or even better ATDT ;)

Though, come to think of it these requests are more likely from credential harvesting bots as most ITSP's provision their CPE with a <macaddr>.cfg or similar.

[ Parent | on HN ]

Re:TFTP Honey Pot Results by racnid on Monday July 13, 2026 @05:32PM (#48899211)

The 00000000000.cfg stuck out to me too, because that's the default/base config name for polycom phones.

[ Parent | on HN ]

Re:TFTP Honey Pot Results by pseudocoder204 on Tuesday July 14, 2026 @03:34PM (#48911930)

Were the spa504g.cfg pulls coming from the same infosec scanner IPs as everything else or from another source? Curious whether the targeted-looking requests actually separate out from the background noise.

[ Parent | on HN ]

Re:TFTP Honey Pot Results by bediger4000 on Tuesday July 14, 2026 @04:06PM (#48912304)

Different source.

[ Parent | on HN ]