Long-form work from Archon Labs. Adversary tradecraft observed in the wild, engineering decisions worth writing down, and product commentary that assumes you can read a packet capture.
In 16 hours, 80 addresses on five continents tried the same unusual password on our SSH honeypot. Every attempt failed. Two of them came back with a common weak password, got in, and installed a miner. What that tells defenders, and the indicators to block.
Read the postThe chain of signals blackpot.io correlates to detect a session coming through a commercial VPN, Apple Private Relay, or a residential proxy — and why any single signal on its own is insufficient.
A traditional honeypot is a fingerprint waiting to happen. blackpot.io tries very hard not to be detectable as one — here's the specific set of choices that make the difference.