The SuckerPot network

Many honeypots. One report.

One honeypot sees one attack. Twenty see a pattern. The SuckerPot network lets nodes pool what they observe, so a bad host is reported once, with stronger evidence, instead of twenty times with weak evidence.

Join in three commands Community blocklist

What it is

A pool you can join and leave at any time.

Nodes share what their sensors saw, in aggregate and without identities. The network confirms a target only when several independent sensors agree.

Opt-in. A node that does not join sends nothing.
No account and no email. A node is at most an optional pseudonym.
Only the facts a report would carry are shared. The hub never stores a node’s address.
Malware links seen by several nodes go to abuse.ch, after a human review.
Leaving takes one click, or one command.

One host, five witnesses, one report.Illustration. Node names are made up.

What is shared

Five items. Never passwords, never commands.

Joining shows you five items, and the API refuses a join unless you confirm all five. Everything else stays on your machine.

Item	What is sent
Attacker addresses	The addresses that attacked your sensors, with the kind of service, a coarse activity and rounded counts.
Download links	Blinded: a SHA-256 hash of the normalised link. The clear link is revealed only after the network confirms the hash.
Malware file fingerprints	Hash, family and file type. The file itself is never sent.
Command servers	Only high-confidence links, backed by a dropper that several sensors fetched.
Takedown checks	Whether a reported target still answers. Not active yet.

Never shared

Usernames and passwords that attackers tried.
Commands typed in a shell, and web requests.
Ports and exact times. Only the UTC day is sent.
Your own address, domain or host name, in any spelling.
Private, reserved and documentation addresses.

Before a batch leaves, the same identity check that protects abuse reports drops any item that names you. Nothing is sent until your own public address is confirmed. The full list is in the documentation.

Consensus

A single node can never publish anything.

Poisoning means sending false sightings to get an innocent address listed. The network makes that expensive. A target is confirmed only when all of these hold. The numbers are defaults the hub operator can change.

At least 5 eligible nodes saw it.
The sightings come from at least two different days, or from 10 nodes.
No single enrolment week supplies more than half of the nodes, so a farm that signs up in one go cannot confirm alone.
An address seen by 5 to 9 nodes also needs a known-bad signal from an outside reputation source, or else 10 nodes.
A command server counts only with a file that at least two eligible nodes fetched.
Public resolvers, big CDN and SaaS domains, package registries and reserved ranges never confirm.
An eligible node is at least 14 days old and sent data on at least 7 of the last 14 days.

Takedowns

Did the report work?

SuckerPot follows what happens to the targets in your reports: is the malware file still served, is the attacking address still active, and how long did the takedown take. Tracking is optional and off by default.

It never hunts back

Target	Contacted?
A malware URL that served a sample to the collector	Yes, one bounded request through the VPN, the same way as the first fetch.
A command-and-control server	Never. No connection, no ping, no banner grab.
An attacking IP address	Never. No connection, no ping, no traceroute.
Any host, for port scans or reverse lookups	Never.

What you see

Each target has one state, shown as an icon and a word: still serving, serving a new file, down or unknown.
A single failed check never means down. A URL is down when its last two checks agree and are far enough apart.
Time to takedown is shown as a window, for example “down between 14:00 and 20:00, 19 hours after the report”.
The Results page counts takedowns within 48 hours, only over targets that were observed for the whole 48 hours.
Providers that answer, and those that ignore reports, are shown side by side.

Reports and takedown tracking use the anonymous VPN road. Confirmed malware hosts and command servers can also go to abuse.ch, where URLhaus and ThreatFox list them for everyone. That is off by default and a person reviews every submission.

Add your sensors to the pool.

Joining gives you no private list and no early copy. It makes the free lists faster and more accurate for everyone.

Participate Full install