Privacy Policy

Written in plain English and kept in step with how the system actually works. It has not yet been reviewed by outside counsel.

1. Who we are

Archon Labs (“we”, “us”) operates blackpot.io: this website, the blackpot console, and a network of internet-facing decoy servers (“sensors”). Contact: [email protected].

2. What we collect

2.1 Website visitors

• Briefing requests. If you fill in the contact form we store your name, email, organization, the note you write, and the IP address the request came from (for spam and abuse control).
• No tracking. The site sets no advertising, analytics, or retargeting cookies and loads no third-party trackers. We don’t keep our own web access logs beyond short-lived system logs.
• Cloudflare. All traffic passes through Cloudflare, which processes your IP address and request details to deliver the site and block attacks, under its own privacy policy.

2.2 Traffic that connects to our sensors

Our sensors are decoy servers. Nobody has a legitimate reason to log in to them, so almost everything they record is automated scanning and attacks. When something connects, we record:

• the source IP address, its network (ASN) and approximate country
• connection details such as TLS and SSH client fingerprints and timing
• usernames and passwords that were tried
• commands typed and HTTP requests sent
• files uploaded, and URLs the attacker tried to download from

We use this to detect and block attacks against our own and our customers’ systems and to research attacker tooling. Our legal basis is legitimate interest in network and information security (GDPR Article 6(1)(f) and Recital 49).

Files attackers leave behind and the files at the URLs they use are kept and analysed as malware samples. We fetch those URLs through the Tor network, never from a sensor address.

2.3 Customers

• Console sign-in. The email address you sign in with (through Cloudflare Access).
• Self-hosted sensors. Data captured by sensors you run stays in your infrastructure unless you send it to us.

3. Who sees it

• The public live attack page. Shows sensor activity at least 15 minutes late, with attacker IP addresses masked (for example 203.0.113.x). It never shows briefing requests or customer data.
• Block lists. IP addresses that attack our sensors may be blocked on our own Cloudflare account.
• AbuseIPDB. We report IP addresses that attack our sensors to AbuseIPDB, a public abuse database. Each report contains the attacking IP address, an attack category (for example SSH brute force or web exploitation) and a short comment describing what it did. Our own operator IP addresses are excluded and never reported.
• abuse.ch MalwareBazaar. We look up the SHA-256 hashes of captured malware samples on MalwareBazaar to identify known malware families. Only the file hash is sent, never the file and never any IP address.

We do not sell personal information, use it for advertising, or enrich briefing requests with data brokers.

4. Service providers

• Cloudflare: DNS, edge delivery, attack blocking, console sign-in
• DigitalOcean: hosting for an internet-facing sensor (US)
• AbuseIPDB: receives reports of attacking IP addresses (see section 3)
• abuse.ch MalwareBazaar: receives malware file hashes for lookup (see section 3)
• The Tor network: carries our downloads of attacker-supplied malware URLs, so those fetches never come from a sensor address

The capture database, backups, and this website run on servers we operate ourselves in the United States.

5. Retention

These are enforced by an automatic nightly deletion job.

• Sensor data that identifies a source (IP addresses, credentials tried, commands, requests, attacker profiles, enforcement records): 13 months, then deleted
• Briefing requests: 24 months from submission, then deleted (or sooner on request)
• Malware samples and their indicators (hashes, wallet addresses, download URLs): kept, because they describe attacker tooling rather than people
• Encrypted database backups: 30 days, so deleted data leaves backups within a month
• The public live page shows only the last 24 hours (7 days for malware URLs) and keeps no history of its own

6. Your rights

Depending on where you live (for example the EU/EEA, UK, or California), you can ask to access, correct, or delete personal data we hold about you, object to or restrict how we use it, and complain to your data-protection authority. Email [email protected] and we will reply within 30 days. For sensor data, tell us the IP address and time involved; an IP address alone often can’t be tied to a person, and we may keep records needed to defend against an ongoing attack.

7. Where data is processed

In the United States. If we transfer personal data from the EEA or UK, we rely on Standard Contractual Clauses or another lawful transfer mechanism.

8. Security

Access to the capture database and console is restricted to our operators. Backups are encrypted (AES-256) and copied to a second machine. See /security for more.

9. Changes

When this policy changes we update the version and effective date above and describe material changes on this page.

10. Contact

[email protected]