blackpot.io answers unknown probes with instrumented decoys, fingerprints the client, pulls hardcoded C2 out of the payloads it catches, and pushes confirmed attackers to a Cloudflare block rule within minutes. Every session opens as a full dossier.
Live from our public sensor snapshot · updated 07:10 UTC · 15-minute delay
blackpot.io is deliberately narrow. It does not compete with your EDR, your SIEM, or your WAF. It sits ahead of them and produces the evidence they do not: where the attacker is coming from, what tooling they run, and what to block before the next stage runs.
Detect traffic arriving through commercial VPNs, hosting networks, Apple Private Relay, and Tor exits from hosting-ASN, JA3/JA4 and (with the optional eBPF module) TCP/UA OS-mismatch signals. When a client runs our page, WebRTC and timezone leaks can expose the network behind the anonymizer.
Bait ports impersonate SSH, Telnet, web apps, Redis, MongoDB, Elasticsearch, Kubernetes, SMB, RDP and SQL servers. Tarpits burn scanner budget while an in-page active profiler collects canvas hashes and checks for Burp / ZAP / Metasploit ports on the attacker’s own host.
Static sandbox extracts Telegram bot tokens, Discord webhooks, and hardcoded exfil IPs from every payload. Session-bound decoy AWS keys and .env dumps trip a webhook the moment an attacker uses one off-site.
Every session opens as a full dossier page in the console — IOC tables, geographic origin, anonymizer signals, linked campaigns, and ready-to-apply iptables / Cloudflare / AWS WAF rules. Confirmed attackers are blocked at Cloudflare and reported to AbuseIPDB automatically.
Illustrative mock of the console.blackpot.io layout — example data, not a screenshot. Real numbers are on the live attack page.
An optional eBPF module (kprobes on tcp_v{4,6}_conn_request) snapshots initial TTL, receive window and TCP flags before user-space sees the byte — the input to the TCP/UA OS-mismatch signal.
ClientHello parsed off the wire; GREASE stripped; JA3 canonical form + MD5 hash + JA4 t-variant token computed inline.
Apple relay CIDRs, hosting-ASN heuristics, TCP-stack vs UA-OS mismatch, and — when a browser runs our page — timezone drift from the injected JS beacon.
For browsers that run our page: canvas hash, WebRTC STUN (which can leak the network behind a VPN) and a local-port check against 8080/8081/9050/4444 for Burp / ZAP / Metasploit.
Telegram bot tokens, Discord webhook URLs, hardcoded IPv4/IPv6, and exfil domains extracted from every POST body.
Every session opens as a dossier in the console. Confirmed attackers are blocked at Cloudflare (AWS WAF and iptables supported) and reported to AbuseIPDB. Canary trips fire webhooks.
Every attacker session gets scored 0–100 by summing the signals that fired. Tier bands drive enforcement decisions. Play with the inputs on the left to see how a scanner turns into a targeted actor turns into an APT engagement.
Scoring weights above are illustrative. The daemon's live weights live in pkg/models/session.go and are configurable per tenant.
Real attacks on our sensors, refreshed every five minutes and published 15 minutes late. Attacker IPs are masked.
Want to see this cut for your zone? A briefing ends with a live attribution stream in your environment.
Book a briefing →Thousands of scanner sessions collapse into a handful of answers: which IPs are one operator, what their malware does to a host, everything an address has ever done to you, and what the sensor already did about it.
IPs are linked when they share hard evidence — the same file, mining wallet, C2 server, planted SSH key, download host, or an unusual password. Public scanners and what-is-my-IP lookups never count as a link.
Files attackers upload or point at are fetched on the sensor, unpacked and triaged statically — never executed. Each capability maps to MITRE ATT&CK, and every hash is checked against MalwareBazaar.
Every address gets a profile: each session and command, the campaigns it belongs to, files it dropped, every block and report against it. A jump box takes an IP, campaign or hash and opens the right page.
Confirmed attackers are blocked at Cloudflare and reported to AbuseIPDB automatically. A whole range is blocked only when three or more attackers sit inside it, your own addresses are never blocked or reported, and any block is released in one click.
Examples from our production sensor as of November 6, 2026. Attacker addresses replaced with documentation IPs; hashes and wallets truncated.
blackpot.io is in alpha and has no customers yet, so there is no logo wall. Its sensor protects the founder's own production SaaS product, and every card below is drawn from that capture database. Attacker IPs are left out.
One host fired 689 requests in 26 seconds while rotating through 422 different User-Agents: 117 path-traversal attempts, 20 remote-code-execution probes including GeoServer CVE-2024-36401, and 313 grabs for .env files, private keys and cloud credentials.
Google Cloud hosts in the US, Japan, Taiwan, the Netherlands, Germany and Singapore swept the bait over five weeks. Four of them used an identical set of ~28 rotating User-Agents and walked 83–94% of the same paths; three more shared over half of both. Different IPs, different regions — fingerprinting ties them to one operator’s scanner.
1,903 requests from 17 Google Cloud hosts claimed to be AI agents and crawlers — Claude, ChatGPT, Perplexity, GPTBot, Kimi, Bytespider. 999 of them asked for .env files, private keys or credential files. Real crawlers don’t go looking for your secrets.
Attackers our sensor confirms are reported to AbuseIPDB, captured malware is shared on abuse.ch MalwareBazaar, and the indicators are published as a free threat feed: plain-text lists your firewall or SIEM can pull, CC0, no sign-up.
In the feed now · last 30 days
Get the free threat feed# one IP per line, comments start with #
curl -s https://blackpot.io/threat-feed/ips.txt
curl -s https://blackpot.io/threat-feed/hashes.txtblackpot.io produces attribution evidence and enforcement actions that WAFs and EDRs consume. If you already run one of these, the matrix below shows where blackpot.io fills the gap.
| Capability | blackpotblackpot.io | HoneypotTraditional honeypot | WAF | EDR |
|---|---|---|---|---|
| Flags VPN / proxy / Tor / Private Relay traffic | Yes | No | Partly | No |
| Extracts C2 infrastructure from payloads | Yes | No | No | Partly |
| Deploys session-bound decoy credentials | Yes | No | No | No |
| Per-session attribution dossier | Yes | Partly | No | No |
| Links attackers into campaigns by shared tooling | Yes | No | No | Partly |
| Requires inline network placement | No | No | Yes | No |
| Requires an agent on every endpoint | No | No | No | Yes |
| Air-gap deployable | Yes | Yes | Partly | Partly |
Our own assessment of blackpot.io alpha-0.2.1 against typical products in each category at time of writing; individual products vary.
A threshold engine promotes anything at Tier APT or score ≥ 80 directly to your enforcement plane. When three or more attackers sit in the same /24, the range is blocked as one rule — and your own addresses are never blocked. Canary trips notify your on-call channel with the tripped token and the session that used it.
| Integration | Action | Status | Detail |
|---|---|---|---|
Cloudflare Access Rules POST /accounts/:id/firewall/access_rules/rules | block | live | POST /accounts/:id/firewall/access_rules/rules |
AbuseIPDB attacker IP + category · operator IPs excluded | report | live | attacker IP + category · operator IPs excluded |
Postgres AsyncWorker · non-blocking | log | live | AsyncWorker · non-blocking |
AWS WAF IPSet wafv2:GetIPSet + UpdateIPSet | block | supported | wafv2:GetIPSet + UpdateIPSet |
iptables / ip6tables IPTablesProvider · CIDR-aware | block | supported | IPTablesProvider · CIDR-aware |
PagerDuty Events v2 canary trip → dedup on token id | page | supported | canary trip → dedup on token id |
Slack Webhook canary-trip card | alert | supported | canary-trip card |
Microsoft Teams Adaptive MessageCard | alert | supported | Adaptive MessageCard |
Custom HTTP POST JSON body · optional auth header | alert | supported | JSON body · optional auth header |
Every session, canary trip, and mitigation push is recorded, and every command an operator sends a sensor is signed and logged. These are the controls in the code today; formal certifications come later and will be listed here only once held.
Read the security overview →Every plan ships the same daemon — the difference is where it runs and what we run on your behalf. Pricing is scoped to your deployment; we'll quote after a short discovery call.
For teams starting fresh.
For hybrid meshes and MSSPs.
For air-gapped or regulated boundaries.
Questions about procurement or a specific environment? Contact [email protected].
A honeypot is where the story starts. blackpot.io is a full instrumented deception surface: TCP-stack fingerprinting (with an optional eBPF module), JS-injected active profiling, C2 payload extraction, campaign linking, and automatic blocking on top. A honeypot logs the knock; blackpot.io answers, fingerprints the visitor, and hands you an attribution dossier.
No. It sits ahead of them. blackpot.io produces evidence and enforcement actions those systems can consume. Its job is to attribute — not to alert on lateral movement inside a compromised host.
Residential proxies are the hardest case, and no tool catches them all. The classifier cross-checks TCP-stack OS (from the SYN) against the declared User-Agent OS; a mismatch from a consumer ASN is a residential-proxy signal. If the client is a browser that runs our page, timezone drift and WebRTC can add corroboration and sometimes expose the network behind the proxy. Scripted scanners that never run JavaScript only give us the network-level signals.
No. A self-hosted sensor does not phone home to us. No session content, dossiers or canary state leaves your environment unless you configure it to: webhooks, Cloudflare blocking, AbuseIPDB reporting and MalwareBazaar hash lookups are each opt-in.
In the console. Every captured session opens as a full dossier page — fingerprints, timeline, payloads, extracted C2, canary state and enforcement — linked to the attacker’s profile and any campaign it belongs to. Data can also be exported as STIX 2.1 or pushed to MISP from the command line.
A single sensor is a docker-compose stack or one Go binary plus Postgres. We have no customer deployments yet, so we won’t quote you a median.
30 minutes with the engineer who built blackpot.io. We walk through live sessions and dossiers from our own production sensor, then scope what a sensor in your environment would catch.