A chronological record of everything we've released. New capabilities, breaking changes, and deprecations are always accompanied by the reasoning behind them.
alpha-0.2.1
Giving back, and staying up when things break
What the sensors catch is now public, and the internet-facing sensor keeps every session through a database outage.
Free threat feed at blackpot.io/threat-feed: attacker IPs, malware hashes and download URLs, CC0, no sign-up
First research post: an 80-IP SSH mining campaign, with the indicators to block
Outage resilience: if the database goes silent, sessions spool to disk within seconds and replay when it returns (proved with a live 9-minute cut, nothing lost)
Sensor health in the console: disk spool, block relay and free disk in every heartbeat, with alerts
Nightly encrypted backups of the internet-facing sensor, checked on arrival
Tighter limits: fake-shell memory and the malware store are capped; the sensor can no longer read the enforcement audit log
alpha-0.2.0
From sessions to intelligence: campaigns, malware analysis, attacker profiles
The console now answers who is behind the traffic and what it does, and the sensor answers back. First internet-facing sensor in DigitalOcean SFO3 alongside the lab node.
Campaigns: attacker IPs linked by shared files, mining wallets, C2 servers, planted SSH keys, download hosts and unusual passwords
Malware pages: static triage of captured files with MITRE ATT&CK mapping and MalwareBazaar lookups — samples never leave the sensor
Attacker profiles: one page per IP with sessions, campaigns, files, blocks and reports; jump box for IPs, campaigns and hashes
Automatic AbuseIPDB reporting and Cloudflare blocking; range blocks only when 3+ attackers share a /24
Operator protection: addresses seen at console sign-in are never blocked or reported
Defense output view: blocks, reports, payloads and canary trips over the last 24 hours
Alpha launch: first sensor live on a production site
First end-to-end deployment of the blackpot.io sensor into a real internet-exposed environment, running alongside a live production SaaS workload. All core detection paths verified against curl-generated traffic; awaiting first real-world scanner engagement.
HTTP bait listener publicly reachable via Cloudflare Tunnel on a production subdomain
Real client IP recovered from Cf-Connecting-Ip header, gated by trusted-proxy ACL
GeoIP + ASN enrichment via DB-IP Lite mmdbs (1.37M country nodes, 1.17M ASN nodes)
~65 HTTP bait paths across 6 categories (config leaks, admin panels, Spring Actuator, server metadata, webshell probes, cloud metadata)
LLM adaptive protocol emulation online via local Ollama (qwen2.5:3b, warmup + 2.5s budget)
User-mode Postgres 18.6 with all six migrations applied
Session persistence with 10-minute retention window; async worker with shutdown-flush safety