Skip to content
ARCHONLABSblackpot.io
Use case · Decoy subdomains

Decoy staging subdomains

Give subdomain enumeration exactly what it’s looking for: a staging environment that looks forgotten, answers like a real app, and reports everything back.

Built for
SaaS teams, compliance platforms, anyone with a public product domain

The problem

Attackers don’t start at your homepage. They run subdomain wordlists and certificate-transparency lookups, looking for the staging box someone forgot to lock down.

A bait host named honeypot. or trap. tells them to walk away. A bait host named staging., evidence. or assessor. looks like exactly the kind of half-finished environment that leaks data.

This is the pattern running live on the founder’s own SaaS product today: decoy subdomains route through a Cloudflare Tunnel to the sensor’s HTTP bait, the console sits behind Cloudflare Access, and enforcement is on.

How it works

  1. 01
    Pick names that fit the product

    Choose bait names that belong on your domain — staging., dev., evidence., assessor., admin-old. Nothing that telegraphs “honeypot”.

  2. 02
    Route through a Cloudflare Tunnel

    Each decoy hostname routes through a Cloudflare Tunnel to the sensor’s loopback HTTP bait. No inbound port opened on your network.

  3. 03
    Don’t link to them

    Nothing on the real product references the decoys. Anyone who arrives found them by enumeration — which is exactly the signal you want.

  4. 04
    High-interaction bait

    The sensor serves a convincing app surface, fingerprints the client, extracts C2 from payloads and plants canary files for anyone who digs deeper.

  5. 05
    Console behind Access

    The blackpot.io console stays behind Cloudflare Access. Operators see the dossier; attackers never see the console.

What you get

  • Bait hostnames that read as real infrastructure
  • No inbound ports — Cloudflare Tunnel only
  • Real client IP via Cf-Connecting-Ip, trusted only from the tunnel peer
  • Fingerprinting, tooling detection and C2 extraction per session
  • Automatic account-level Cloudflare blocks when enforcement is on

Set it up

Uses the same tunnel and sensor as the rest of the platform.

  1. 01 · Create the tunnel
    $ cloudflared tunnel create blackpot-bait
  2. 02 · Route each decoy hostname to it
    $ cloudflared tunnel route dns blackpot-bait staging.yourdomain.com
$ cloudflared tunnel route dns blackpot-bait evidence.yourdomain.com
  3. 03 · Point the ingress at the sensor’s HTTP bait

    Ingress rule → http://127.0.0.1:8080. See the integrator guide for the full config.

  4. 04 · Or let Site Shield do it
    $ deploy/site-shield/shield.sh plan sites/yourdomain.com.env

FAQ

Won’t the decoys show up in certificate transparency logs?
Yes — that’s part of the point. CT logs are one of the ways scanners find subdomains. A decoy that appears there gets visited.
Can I use the console domain as a decoy?
No. Keep the console on its own hostname behind Cloudflare Access. Decoys should only ever route to the bait listener.

Related docs

More use cases
← Back to all use cases