Why we built a honeypot with manners
A traditional honeypot is a fingerprint waiting to happen. blackpot.io tries very hard not to be detectable as one — here's the specific set of choices that make the difference.
There is a reason every list of "top honeypot platforms" has been essentially the same set of tools for a decade. Real adversaries fingerprint them in seconds and route around them, so serious defenders stopped investing in the category. blackpot.io started from the observation that the fingerprint problem is a design problem, and design problems can be redesigned.
The problem with the classic honeypot fingerprint
Classic honeypots betray themselves via:
- Default banners ("Cowrie SSH", "Dionaea SMB") that appear verbatim in every scan corpus
- Response timing patterns that are too fast (no real service is 100 microseconds consistent) or too slow (tarpits with obvious drip cadences)
- Deployment placement: single hosts sitting at low-numbered IPs in a /24 that has nothing else on it
- Response content: every fake .env has the same three variable names in the same order
- Certificate chains that give away the ops team ("issued to [email protected]")
What we do differently
The blackpot.io HTTP bait ships ~65 real endpoint responses across six categories (config leaks, admin panels, Spring Boot Actuator, server metadata, RCE probes, cloud metadata). Every response is generated per-session — the "fake" WordPress config a scanner sees at 03:14 UTC is not byte-identical to the one they see at 03:15 UTC. The canary tokens embedded in each response are session-bound and cryptographically distinct.
An optional LLM layer takes it further. It is off by default; when enabled, for protocols with a wide command surface (Redis, MongoDB) the daemon can consult a local Ollama-compatible model for commands it doesn't recognize statically. Scanning "known Redis commands" produces the expected static reply, while probing something obscure gets a plausible, context-aware answer instead of an obvious dead end.
Response timing is the next frontier. A fake service that answers every command in exactly the same few microseconds is a fingerprint; shaping response timing to match the impersonated product is on our roadmap.
Where we're still visible
No deception is total. A determined adversary who invests hours can figure out that a target is instrumented — either through side-channels we haven't closed (timing under sustained load, thermal fingerprinting of the hosting environment, out-of-band DNS enumeration of the surrounding zone) or by simply asking someone. Our design goal is not to be invisible; it is to raise the cost of detection to the point where the marginal attacker moves on to an easier target. That's the entire point of deception at scale: not perfect stealth, but a tax on attacker attention.
The most honest description of blackpot.io is: a honeypot that has read every classic honeypot-detection paper and refactored itself to avoid the specific fingerprints. It's not novel science. It's just careful engineering, applied to a category the industry left for dead.