Loading
Threat intelligence built on SikkerNet, a distributed honeypot network that captures real attacker behavior across 17 protocols in real-time
SikkerAPI started as SikkerNet, a private honeypot network built to study what attackers do after gaining access to a system. The sensors accept all credentials because the goal is observing post-authentication behavior: command execution, lateral movement, malware staging, persistence mechanisms, and data exfiltration.
SikkerNet grew into a global sensor fleet processing millions of events per day. We built an API around it to give security teams, developers, and researchers access to the same threat data. Every feature is available on the free tier. Paid plans expand capacity, not functionality.
Each SikkerNet sensor is a custom honeypot application written in Kotlin that simultaneously emulates 17 network protocols: SSH, HTTP, FTP, SMTP, MySQL, PostgreSQL, MongoDB, Redis, Docker, Telnet, Elasticsearch, MSSQL, IMAP, SMB, RTSP, SIP, and RDP. Unlike low-interaction honeypots that only log connection attempts, our sensors accept all credentials and engage attackers in realistic post-authentication environments.
The SSH honeypot alone implements 105+ commands with full argument parsing, realistic output, and a virtual filesystem that persists across the session. Attackers run uname, whoami, nvidia-smi, curl, wget, docker ps, crontab and get convincing responses for each one. This captures real attack tooling, malware download URLs, and persistence mechanisms that low-interaction honeypots cannot observe.
Every event is captured raw and uninterpreted. The sensor records exactly what the attacker did at the byte level. Analysis, scoring, and classification happen centrally after ingestion. Sensors are disposable: if one is compromised, it can be replaced in under a minute. Events are buffered locally and delivered with at-least-once guarantees, so nothing is dropped when the central infrastructure is temporarily unreachable.
Raw events from sensors are processed by our editorial engine, which decomposes attack activity into two layers. Primitives are atomic indicators: a specific command, download URL, credential pattern, or SQL query matched by operators like EQUALS, CONTAINS, WILDCARD, or REGEX. Behaviors are composite attack classifications built from multiple primitives using AND/OR logic, each mapped to MITRE ATT&CK techniques with a severity level.
Each session is matched against exactly one behavior through exact set matching: every primitive in the session must be accounted for by the behavior definition, with no extras. An IP accumulates multiple behaviors across separate sessions. The editorial engine tracks a growing catalog of behaviors and primitives across SSH, Telnet, SIP, HTTP, and other protocols. The full catalog is browsable on the threat catalog page.
Every observed IP address receives a confidence level from 0 to 100 derived from two evidence sources. Sensor evidence weighs behavior severity, primitive matches, protocol diversity, and session volume. Community evidence weighs individual reports and bulk submissions from defenders, factoring in unique reporter count, report volume, and category severity. When both sources corroborate on the same IP, a multiplier boosts the final score.
Scores are evidence-based and transparent. You can inspect the exact behaviors, primitives, session counts, and community reports behind every score. The scoring methodology is documented. Known-benign scanners like Googlebot and Censys are discounted, with an override parameter to view the raw undiscounted score.
The IP Check API returns confidence levels, geolocation, behavioral classifications, protocol breakdowns, and community report data in a single request. The blacklist endpoint generates filtered IP lists by country, ASN, protocol, severity, and confidence threshold. Bulk reporting handles up to 10,000 IPs per request. STIX/TAXII 2.1 feeds are compatible with Splunk, Microsoft Sentinel, Elastic Security, and QRadar.
SikkerGuard is our server firewall application that pulls threat data from the API and blocks malicious IPs at the kernel level using iptables/ipset on Linux and Windows Firewall on Windows. Blocked connections are reported back to improve the dataset. Integration guides are also available for Fail2Ban, CSF, nginx, and iptables. The CLI tool queries IP reputation and downloads blocklists from the terminal.
SikkerAPI is founder-built and independent. Students, university researchers, and contributing security professionals get free access. No credit card required. Create a free account or read the API documentation.