more

internal/honeypot/honeypot.go

@@ -135,7 +135,7 @@ func (t *Tracker) record(ip string) bool {
 	}
 	state.Count++
 	state.LastSeen = now
-	if state.Count > t.threshold {
+	if state.Count >= t.threshold {
 		state.PromotedUntil = now.Add(t.ttl)
 	}
 	t.clients[ip] = state
@@ -145,6 +145,19 @@ func (t *Tracker) record(ip string) bool {
 	return !state.PromotedUntil.IsZero() && now.Before(state.PromotedUntil)
 }
 
+// RecordTelemetry records a suspicious request observed in an OTLP span. This
+// is separate from Middleware because the request may have been handled by a
+// different application/ingress host while its telemetry is sent to this
+// collector. No decoy response is written here; this only updates the
+// promoted-IP feed.
+func (t *Tracker) RecordTelemetry(ip, path string) bool {
+	ip = strings.TrimSpace(strings.SplitN(ip, ",", 2)[0])
+	if ip == "" || !isSuspiciousPath(path) {
+		return false
+	}
+	return t.record(ip)
+}
+
 // PromotedIPs returns a snapshot suitable for an ingress synchronizer.
 func (t *Tracker) PromotedIPs() []IP {
 	now := time.Now()