Security research, threat intelligence insights, and product updates.
SikkerAPI's honeypot network expands to 44 sensors across 23 countries with new deployments in Hong Kong, Qatar, Belgium, Sweden, and two US locations. More geography means more attacker visibility.
SikkerAPI now integrates directly with Nginx and iptables/ipset. Block threat-intelligence-backed IPs at the firewall or web server level with zero-downtime updates — free, no code required.
SikkerAPI now supports CIDR Range Alerts, enabling automated IP range monitoring and subnet-level threat intelligence alerts. Monitor entire CIDR blocks and receive notifications when IPs inside your network are detected — available on all plans, including Free.
The SikkerNet editorial engine just received a major UI and workflow update. You can now import commands directly from live sessions, sample patterns against real historical telemetry before publishing. The result is faster, more precise primitive and behavior classification across millions of daily honeypot events.
A look behind the scenes at how SikkerAPI’s high-interaction honeypot network operates, what kind of telemetry it captures, and how raw attacker activity is transformed into atomic primitives and structured behavioral intelligence.
Over 24 hours, 59,874 SIP sessions hit all 39 SikkerNet sensors, every one from US cloud infrastructure. Two IPs generated 78% of the traffic. We break down the actors, tactics, and what our SIP honeypot captured.
SikkerNet's editorial engine now covers all sixteen protocols with the addition of RTSP, MSSQL, MongoDB, SMB, SMTP, and HTTP/S modules — bringing structured behavioral classification to every protocol in the honeypot network.
Recent SikkerNet telemetry shows Lithuania receiving unusually high volumes of SMTP, Telnet, and SIP abuse, diverging from the SSH-heavy patterns seen across most other sensors.