★ President's pick

Robots hunt for forgotten "keys" and open admin panels: what our traps saw this week

Starbound Academy · One section each for elders, professionals and executives

The data

Window: Oct 18, 2026, 7:28:59 PM ET to Oct 25, 2026, 7:28:59 PM ET (168 hours). Pulled Oct 25, 2026, 7:28:59 PM ET (US Eastern Time, ET). Aggregate counts only, no addresses or request details.

• Total trap hits: 2,023 from 279 distinct sources (86 repeat visitors), across 4 lab hosts plus 292 hits with no host recorded.
• Config and secret-file hunting (exact-match labels): ≥62 hits.
• Backup-file hunting: ≥32 hits.
• Admin and setup-panel probing: ≥31 hits.
• Automated scanning is fast: the busiest source made 135 requests in about 90 seconds (most of it across 87 distinct paths).

Caveat: since a classifier change, only exact matches are labelled; 1,731 hits are lumped as "other probe". The category counts above are therefore lower bounds, and the share of each category inside "other probe" is UNVERIFIED. This is not a real shift in attacker behavior.

For elders

What happened

We put "bait" online: empty trap websites. In one week they were knocked on more than 2,000 times. Almost all of it was robots. They do not pick a victim. They check everything, looking for a door someone left open or a key under the mat.

Why it matters to you

Your home router (the Wi-Fi box), camera or "smart" device is on the internet too. Robots look for devices with old software and factory passwords. This happens to careful people, and it can be fixed.

Our traps are web hosts. This home-device advice is general best practice [4], not a lab finding (UNVERIFIED that home routers or cameras were specifically targeted).

3 do-now steps

1. Change the factory password on your router and cameras. Ask a relative you trust to help.
2. Turn on automatic updates on your phone, computer and router.
3. Don't keep passwords in plain files or notes others can see. Use a password manager or a notebook kept at home.

How to spot it

• Wi-Fi suddenly gets slow
• a device restarts by itself
• an unknown user appears in settings
• the router password is the one on the sticker and was never changed

If it happened to you

Call someone you trust, or your internet provider's support (number on your bill). Change passwords together. If money is missing, call your bank using the number on your card. In the U.S. you can report at www.ic3.gov/. It is not your fault.

For professionals

What happened

Over 168 hours our traps logged 2,023 hits from 279 sources. Among exactly-recognized patterns, two lead: (1) hunting for configuration and secret files (environment files, version-control settings, service-account keys, sample configs) and backups, at least 94 hits; (2) probing for admin panels and setup pages (including DNS, Domain Name System, control panels and CMS, content management system, installers), at least 31. This matches OWASP's (Open Worldwide Application Security Project) "Security Misconfiguration" category [1].

Why it matters to you

One forgotten file with a database password or cloud key on a web server, and an attacker doesn't need to hack anything. Scanners check dozens of paths in seconds, around the clock.

3 do-now steps

1. Never put secrets in a web root or a repository. Use a secrets manager; turn on secret scanning for repositories [2].
2. Remove backups and test files from public servers; ask IT to confirm directory listing is off.
3. Ask IT to take admin panels off the open internet (VPN, virtual private network, or an allow-list) and require MFA (multi-factor authentication).

How to spot it

• log bursts of 404s across many different paths within seconds
• requests for config or backup filenames
• hits on login pages you don't run
• the same sources returning repeatedly

If it happened to you

Report to IT/security first. If a secret was publicly reachable, treat it as compromised: revoke and rotate it, then review access logs. For financial loss in the U.S., report at www.ic3.gov/.

For executives and public figures

What happened

In one week, more than 2,000 automated probes of our traps from 279 sources. Main targets: forgotten secret files, backups and exposed admin panels. Attackers operate at scale and cheaply; any misconfiguration will be found.

Why it matters to you

A leaked key or a hijacked DNS or website panel hits reputation, customer data and regulatory obligations harder than it hits technology.

3 decisions

1. Policy: secrets only in a secrets manager; admin panels off the open internet and behind MFA.
2. Oversight: quarterly external attack-surface review, with fixes for CISA (Cybersecurity and Infrastructure Security Agency) KEV (Known Exploited Vulnerabilities) catalog items prioritized [3].
3. Ownership: name an owner for personal and family domains, email and DNS, including registrar accounts.

How to spot it

• no list of who owns domains and panels
• keys shared in chats or files
• nobody has seen an external-exposure report this quarter

If it happened to you

Security lead → legal/comms → official channels (U.S.: www.ic3.gov/). No public comment before assessment.

Sources

Trap figures: Starbound lab trap telemetry, 168 hours, aggregate figures only (not public). Not claimed: whether any known-CVE path scans occurred (not separable in this data).

1. OWASP Top 10, A05:2021 Security Misconfiguration
2. GitHub Docs, About secret scanning
3. CISA Known Exploited Vulnerabilities Catalog
4. CISA Secure Our World
5. FBI IC3

---

With care, the Starbound team