ip(); AuditEvent::create([ 'user_id' => null, 'actor' => 'system', 'action' => 'security.honeypot_hit', 'target' => Str::limit($request->path(), 190), 'ip' => $ip, 'meta' => [ 'ua' => Str::limit((string) $request->userAgent(), 190), 'method' => $request->method(), 'query' => Str::limit((string) $request->getQueryString(), 190), ], ]); app(BruteforceGuard::class)->banNow($ip, 'honeypot'); return $this->deceive($request); } /** Pick a convincing fake response for the probed path. */ private function deceive(Request $request): Response { $path = strtolower($request->path()); if ($path === '.env') { return response($this->fakeDotenv(), 200, ['Content-Type' => 'text/plain; charset=UTF-8']); } if (str_starts_with($path, 'wp-login.php') || str_starts_with($path, 'wp-admin')) { return response($this->fakeWordPress(), 200, ['Content-Type' => 'text/html; charset=UTF-8']); } if (str_starts_with($path, 'phpmyadmin')) { return response($this->fakePhpMyAdmin(), 200, ['Content-Type' => 'text/html; charset=UTF-8']); } return response($this->fakeGenericLogin(), 200, ['Content-Type' => 'text/html; charset=UTF-8']); } /** Plausible-looking dotenv seeded with the three config canaries (the bait). */ private function fakeDotenv(): string { $c = (array) config('clusev.honeypot.canaries'); return implode("\n", [ 'APP_NAME=Application', 'APP_ENV=production', 'APP_KEY='.($c['app_key'] ?? ''), 'APP_DEBUG=false', 'APP_URL=https://app.internal.example.com', '', 'DB_CONNECTION=mysql', 'DB_HOST=10.20.0.14', 'DB_PORT=3306', 'DB_DATABASE=app_production', 'DB_USERNAME=app_prod', 'DB_PASSWORD='.($c['db_password'] ?? ''), '', 'AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE', 'AWS_SECRET_ACCESS_KEY='.($c['aws_secret'] ?? ''), 'AWS_DEFAULT_REGION=eu-central-1', '', ]); } private function fakeWordPress(): string { return <<<'HTML' Log In ‹ Blog — WordPress

Powered by WordPress

HTML; } private function fakePhpMyAdmin(): string { return <<<'HTML' phpMyAdmin

Welcome to phpMyAdmin

Log in
HTML; } private function fakeGenericLogin(): string { return <<<'HTML' Sign in

Sign in to continue

HTML; } }