What does 25~ days worth of honeypot telemetry look like?

A lot, is the answer, a hell of a lot.

Cost of operation

SikkerAPI’s proprietary honeypot network captures telemetry worldwide across dozens of high-interaction sensors. Each sensor fully emulates 16 protocols in Kotlin, designed to be lightweight and resource-efficient.

A single SikkerAPI sensor can run comfortably on low-cost VPS instances with as little as one vCPU and 1 GB of RAM, keeping operational overhead relatively low while still collecting high-fidelity interaction data.

What do we capture?

Much of the raw telemetry we collect is not exposed publicly. Instead, it is used internally to generate atomic primitives which are then combined into composite behaviors. These behaviors are what users consume through threat-intelligence feeds, firewall integrations, and the public API.

If you’re interested in exploring the primitives and behaviors we generate, you can browse the detection catalog.