A defense tool built for people who read the packet.
blackpot.io is an Archon Labs platform, built by one engineer on a simple observation: detection tools are exhaustively documented, and adversaries know exactly how to avoid every one of them. Deception flips that — the attacker has to guess what is real.
The thesis
Every enterprise security stack today looks the same on the wire: an EDR agent, a WAF, a SIEM, a SOAR, a dozen SaaS integrations feeding a rules engine. That stack is designed to catch a mistake from someone who has already gotten in. It is not designed to answer who is trying to get in, and where are they really coming from.
Adversaries know the shape of that stack. They know which JA3 hashes are safe to use, which paths trip a WAF, which sudo commands go straight to a SIEM. They know how to route through a residential proxy, spoof a JA4, and time their probes for shift changeover. Attribution is where a $0/mo hobby operator and a state-adjacent actor start to look identical, and where every existing tool goes silent.
blackpot.io closes part of that gap by inverting the model. Rather than trying to spot the intruder after they arrive, it builds the intrusion surface. Every bait port is instrumented; every response is deceptive; every session becomes a dossier that records which network it came from, what tooling it ran, what it tried to take, and what else it is linked to.
Where blackpot.io fits
blackpot.io is a deception platform, an attribution engine, and a reporting layer, wrapped in a Go daemon that one person can operate. It runs beside your existing security stack — not instead of it — and produces artefacts that stack does not: anonymizer verdicts, C2 endpoints and wallets stripped from payloads, campaigns linking attackers that share tooling, and blocks pushed to Cloudflare.
It is designed to be small enough that a single engineer can audit the whole codebase — because a single engineer wrote it and runs it. Every number on this site comes from its own capture database, and the live attack page shows the sensor working right now.
Built in the open, on a real site
blackpot.io is built by one engineer. There is no sales team, no investors, and no customer list yet — it is a pre-launch alpha. What it does have is production traffic: a lab node has protected the founder's own production SaaS product since August 2026, joined in November by an internet-facing sensor (DigitalOcean, US). Everything the platform claims to do, it does there first.
If you're a defender who has ever wanted to know more about who was on the other end of a probe, you'll recognise the motivation. If you want to talk through your own problem before deploying anything, please book a briefing; none require a purchase order.
Where to reach us
General & alpha access: [email protected]
Security disclosures: [email protected] (see /security for the disclosure policy)
Press & research: [email protected]