Unmasking Deception: Navigating Red Herrings and Honeypots

Censys researchers detected and analyzed a large set of deceptive hosts that generate oversized, noisy HTTP responses (including 37kB Server headers) built from Nuclei matchers, Rapid7 Recog examples, and a GitHub dataset. These services—characterized as tarpit-like and likely intended to confuse or pollute internet scanners—were concentrated in AWS autonomous systems (with early activity linked to China-operated AWS blocks), affected tens of thousands of services, and appear designed to trigger many vulnerability-identification rules rather than to directly exploit victims.