Security research, threat intelligence insights, and product updates.
We observed a Redis exploitation bot in its natural habitat: an unprotected instance on port 6379. What followed was a textbook cron injection, captured in full by our honeypot network. INFO recon, 6.5 seconds of stillness, then 25 commands in 11 seconds. A parasitoid wasp in digital form.
We're opening 10 review plan slots — 30 days of elevated API access for anyone who wants to properly test SikkerAPI against their infrastructure.
Our honeypot sensors emulate exposed Docker daemons and record everything attackers do. We pulled a 24-hour snapshot: 3,964 events from 144 IPs, container escapes via nsenter, SSH key backdoors locked with chattr, a self-replicating worm from 100 IPs, and cron persistence — all before anyone touched the application layer.
Check if your email address has been targeted in phishing or spam campaigns. 110,000+ emails tracked from real SMTP attacks captured by our global honeypot network. Free to search.
Our Doha honeypot captured a massive SMTP phishing operation overnight. 3,664 events, 378K+ targeted email addresses, and a Powerball lottery scam impersonating a real lottery winner. Here's the full breakdown.
SikkerGuard pulls SikkerAPI's threat blacklist and blocks malicious IPs at the kernel level using iptables and ipset. One Docker container, one API key, zero maintenance. Free tier included.
Browse 33,000+ usernames from real brute-force attacks across SSH, FTP, Telnet, and 11 more protocols. Free to search, updated daily from live honeypot data.
A new bot is actively identifying Cowrie, Kippo, Dionaea, Glastopf, OpenCanary, and Honeytrap installations before deciding whether to attack. We captured the full session. Nobody else is talking about this.
Attack behaviors in the SikkerAPI detection catalog now display their underlying primitives as clickable tags. Browse the relationship between high-level attack patterns and the low-level detection rules that compose them.
Check IP reputation, download blacklists, report abuse, and query TAXII feeds without leaving the terminal. Available now via npm.