Skip to content
ARCHONLABSblackpot.io
Use case · Shared enforcement

One catch, every domain blocked

Trap the attacker on one domain and block them on all of them. Enforcement lands as account-level Cloudflare rules, not per-site config.

Built for
MSPs, MSSPs, fractional CISOs, anyone running a portfolio of domains

The problem

If you manage ten domains, the scanner that probes one of them is probing the other nine. Per-site blocklists mean you learn the same lesson ten times.

Fractional CISOs and MSPs feel this most: many small properties, no SOC per client, and no time to copy indicators between dashboards.

How it works

  1. 01
    Shield the cheap domains first

    Put Site Shield on the low-value sites — marketing pages, personal sites, parked domains. They attract the same scanners as production, with nothing at stake.

  2. 02
    Catch and attribute

    Trap paths and decoy subdomains feed the sensor. Each session gets fingerprinted, scored and attributed.

  3. 03
    Push an account-level rule

    When enforcement fires, blackpot.io writes a Cloudflare access rule at the account level — not the zone — so it applies to every domain in the account.

  4. 04
    Production benefits for free

    The attacker who tripped a decoy on a parked domain is already blocked when they reach the domain that matters.

What you get

  • One block, enforced on every domain in the Cloudflare account
  • Low-value domains turned into early-warning sensors for high-value ones
  • One sensor and one console across the portfolio
  • Per-domain rollback with shield.sh remove — enforcement stays shared

Set it up

Run Site Shield once per domain. Enforcement is shared automatically because it lives at the account level.

  1. 01 · Preview each domain
    $ deploy/site-shield/shield.sh plan sites/<domain>.env
  2. 02 · Apply each domain
    $ deploy/site-shield/shield.sh apply sites/<domain>.env
  3. 03 · Confirm traps and enforcement
    $ deploy/site-shield/shield.sh verify sites/<domain>.env

FAQ

What if my clients are in separate Cloudflare accounts?
Account-level rules cover one account. Domains in separate accounts each get their own rules.
Can I turn enforcement off and just observe?
Yes. Enforcement is a switch. Run in observe mode first, review the dossiers, then turn blocking on.

Related docs

More use cases
← Back to all use cases