Sensor Network
6 sensors, 20 emulated services each
BlackDome runs 6 sensors. Each sensor runs the same 20 emulated services. Sensor addresses are not published, so the sensors stay useful.
Locations
Where the sensors run
| City | Country |
|---|---|
| Sydney | Australia |
| Helsinki | Finland |
| New York | United States |
| London | United Kingdom |
| Bangalore | India |
| Toronto | Canada |
Services
What each sensor emulates
| Port | Service | Persona | Captures |
|---|---|---|---|
| 21 | FTP | vsftpd file server | Logins and credentials, file operations |
| 22 | SSH | Ubuntu 22.04 server with an interactive shell | Logins and credentials, shell commands, downloaded files |
| 23 | Telnet | Legacy NAS | Logins and credentials, shell commands |
| 25 | SMTP | Corporate mail server | Auth attempts, relay commands (EHLO, VRFY) |
| 53 | DNS | Corporate internal DNS | DNS queries, including suspicious lookups |
| 80 | HTTP | Admin panel | Requests, client fingerprints, login attempts, exploit (CVE) probes, uploaded files |
| 443 | HTTPS | Admin panel (TLS) | Requests, client fingerprints, login attempts, exploit (CVE) probes |
| 445 | SMB | Finance domain controller | Negotiation and auth attempts, SMBv1 probes |
| 502 | Modbus/TCP | Industrial PLC (Modicon-style) | Function codes, read/write attempts, device identification scans |
| 3306 | MySQL | MySQL 5.7 database | Logins and credentials, queries |
| 5432 | PostgreSQL | Application database | Logins and credentials, queries |
| 5900 | VNC | Remote desktop (RFB) | Handshakes, authentication attempts, session negotiation |
| 6379 | Redis | Redis 6 cache | Commands, including CONFIG/cron exploitation chains |
| 6443 | Kubernetes API | Kube apiserver | API discovery, auth attempts, exec/create calls |
| 9200 | Elasticsearch | Elasticsearch 7.17 | Queries and probes |
| 10250 | kubelet | Kubernetes node agent | /pods, /exec probes, auth attempts |
| 2323 | Telnet (alt) | Legacy NAS | Logins and credentials, shell commands |
| 2375 | Docker API | Docker 24 daemon | API calls, container create/exec attempts |
| 27017 | MongoDB | Application data store | Database commands |
| 3389 | RDP | Windows Server (FIN-TS01) | Connections, usernames, NLA credential capture |
What we capture
- Connection metadata on every service.
- What each service can carry, listed per service above: credentials where the protocol has logins, commands and queries, and exploit attempts.
- Files and payloads that attackers upload or reference are stored as evidence. Some are detonated in an isolated sandbox; detonation does not yet cover every payload.
- Everything is tied to the session that produced it.
What we filter
Scan-only traffic is rate-limited and summarised. Above 120 events per source IP per minute, further events are counted, not stored individually.
How indicators are published
- Timestamps are in UTC.
- Each IP indicator records first seen, last seen, and how many sensors saw it.
- IP indicators expire 30 days after last seen. Domains and URLs expire 90 days after last seen. File hashes never expire.
- STIX 2.1 export is available from Threat Intel Pro up; real-time TAXII 2.1 pull is an Enterprise feature. MISP and similar platforms can ingest both.
- A redacted, delayed preview is public at /intel; its Sensors column shows how many sensors saw each IP.
Known gaps
Research scanners (Shodan, Censys, Shadowserver, Stretchoid, and others) are identified by forward-confirmed reverse DNS, excluded from attacker counts and the leaderboard, and reported separately on the homepage counters.