/*
 * .htaccess
 */
<FilesMatch "^honeypot_image.png$">
	AddType application/x-httpd-php .png
</FilesMatch>

/*
 * honeypot_image.png
 */
<?php
// We're an image. Really!
header("Content-type: image/png");

// Only do the logging for the desired IP.
if ($_SERVER['REMOTE_ADDR'] == "1.2.3.4") {

	// Log file location - use pid as name.
	$log = "path/to/log/" . getmypid() . ".log";

	// When?
	$result = date("d.m.Y H:i:s T") . "\n\n";

	// From where?
	$result .= "Client Port: {$_SERVER['REMOTE_PORT']}\n\n";

	// Maybe whatever it is handles cookies, then it might have interesting session data
	session_start();
	$result .= "Current Session: " . print_r($_SESSION, true) . "\n\n";
	// ... and interesting cookies, too. :)
	$result .= "Cookies: " . print_r($_COOKIE, true) . "\n\n";

	// Catch all running processes
	$result .= shell_exec("ps aux") . "\n\n";

	// Get all connections including handling processes. (Requires netstat to be run as root, a temporary suid root helps)
	$result .= shell_exec("netstat -anp") . "\n\n";

	// Grab the server status. If it's an apache process, we get the script that way. (needs mod_status)
	$result .= shell_exec("lynx -dump http://1.2.3.4/server-status"). "\n\n";

	// Write to disk.
	file_put_contents($log, $result, FILE_APPEND);
}

// Didn't I say we're an image? :)
echo file_get_contents("the_real_image.png");