One homelab. 300,000+ protected installations. Every attacker that touches this infrastructure makes the entire internet safer.
Built by LiΘneanu Dumitru-Cristian β from a 44 mΒ² apartment near IaΘi, Romania
Dell Precision 7910 Β· Xeon E5-2699 v4 Β· 88 threads Β· 503 GiB RAM Β· RTX 4060 Ti
π― The Pipeline
Every attacker follows this path. They think they found a vulnerable server. What they found is a trap wired to 300,000 security systems worldwide.
Shodan, Censys, or mass scanning finds port 22 open. It looks like a real Linux server with weak credentials.
ATTACKER PERSPECTIVEThe attacker connects to a high-interaction SSH honeypot. They see a realistic Debian shell, working file system, fake services. They think they're in.
TRAP ACTIVEEvery credential attempt, every command, every keystroke, every malware download β captured in real-time. TTY sessions recorded for replay.
331,799 EVENTS CAPTUREDIn parallel, CrowdSec IDS parses 1.21M+ Traefik access log lines in real-time. CVE exploits, brute force attempts, WordPress scanners, path traversals β all classified and scored.
1.21M LOG LINES PARSEDCrowdSec pushes the ban decision via REST API to the MikroTik CCR1009 router. The IP is dropped at the network edge β before it even reaches the server. Currently 597 active address-list entries.
BLOCKED IN SECONDSReal-time Telegram and Discord notifications fire. The operator sees attacker IP, attack type, ban duration, and GeoIP data β from their phone, anywhere in the world.
REAL-TIME ALERTSThe attack signal is pushed to the CrowdSec Central API β a global threat intelligence network of 300,000+ installations. 33,120+ signals contributed from this infrastructure alone.
33,120+ SIGNALS SHAREDThe IP is now flagged across the entire CrowdSec community. Every installation that subscribes to the community blocklist will preemptively block this attacker. One trap, global protection.
GLOBAL BAN PROPAGATEDCowrie logs stream to Loki via the custom cowrie-to-loki pipeline. Grafana dashboards visualize attack patterns, credential trends, geographic origins, and malware families.
DASHBOARDS Β· ANALYTICS Β· REPORTSFirst offense: 3-hour ban (Tier 0). Return visitor: 1-week ban (Tier 1). Persistent threat: permanent ban (Tier 2). The system has memory. Repeat offenders don't get second chances.
TIER 0 β TIER 1 β TIER 2: 3h β 1 WEEK β PERMANENTπ Real Numbers
Not estimates. Not projections. These are verified counts from production systems β running right now, 24/7/365.
𧬠Classification
Every probe, scan, and exploit attempt is classified, scored, and catalogued. Here's what's hitting this infrastructure β right now.
Automated scanners probing for exposed endpoints, version fingerprinting, and service enumeration across all HTTP surfaces.
wp-login, xmlrpc.php, wp-admin brute force, plugin vulnerability scanning. We don't even run WordPress.
Probing for .env files, .git directories, database dumps, backup archives, API keys left in public directories.
Aggressive crawlers hitting dynamic endpoints, API routes, and application paths far beyond normal indexing behavior.
Scanning for /admin, /manager, /phpmyadmin, /adminer, cPanel, and other administrative interfaces.
Attempting to access known web shells, backdoor paths, and remote code execution endpoints left by previous compromises.
Atlassian Jira Server file read vulnerability exploitation attempt. Path traversal to read arbitrary files from Jira installations.
FortiOS SSL VPN credential theft attempt. Path traversal to extract plaintext credentials from /dev/cmdb/sslvpn_websession.
Microsoft Exchange ProxyNotShell RCE. Attackers scanning for vulnerable Exchange servers to achieve remote code execution.
Directory traversal attacks and Netgear router remote code execution attempts. Scanning for vulnerable network equipment.
Imagine a fully transparent office building in the middle of a busy street. Floor-to-ceiling glass walls. Anyone can look inside. It looks inviting β maybe even vulnerable.
But the glass is bulletproof. And the interior? Those are LCD screens projecting a convincing fake office. The real operations happen in a bunker underneath.
That's what attackers see when they probe this infrastructure.
The Cowrie honeypot is the LCD screen β a pixel-perfect simulation of a vulnerable server that records every move. CrowdSec is the security camera system capturing everything in HD. The MikroTik firewall with its 4-chain architecture is the bulletproof glass β 79 filter rules thick.
And every recording β every credential attempt, every exploit, every malware sample β gets sent to every security company in the world. Not metaphorically. Literally. 300,000+ installations receive our threat intelligence in real-time through the CrowdSec Central API.
The attackers aren't just failing. They're making every other target on the internet harder to attack.
π― Live Telemetry
Every 404 hitting the landing-page nginx is logged with the original request URI and aggregated into /honeypot-stats.json. This is what bots are looking for on this infrastructure in the last 24 hours β directly, without filtering.
Scope: nginx pod in shuffle-on-landing namespace only β not the cluster-wide attack surface. Source: Loki query {namespace="shuffle-on-landing", app="landing"} | json | status="404". The request_uri log field was added 2026-04-30 β give it 24h to fully accumulate.
π Subdomain Reconnaissance
Wildcard DNS routes *.shuffle-on.com to the cluster. Subdomains without an IngressRoute fall through to a catchall middleware that rewrites the path to a sentinel and serves a 404. The Host header preserves what the scanner *guessed* β giving a real-time view of attackers' mental model of this infrastructure's namespace.
This is reconnaissance against the namespace, not against any specific page. Each entry is a Host header that doesn't have a real IngressRoute behind it β i.e., a guess. Common guesses (admin, portainer, guacamole, lsn-redis) reveal scanner dictionaries; uncommon ones reveal what's been leaked elsewhere about the operator's stack.
β‘ Incident Report
A real incident. Our pentesting activity triggered a counter-response from the LeakIX sensor network. Our defense stack caught them before they finished their first probe.
During authorized outbound security testing, the infrastructure's scanning activity was detected by LeakIX β a large-scale internet sensor network that monitors scanning behavior globally.
Within seconds of our first outbound probes, LeakIX nodes began counter-scanning our IP ranges. They came to investigate us β to fingerprint our services, identify our stack, and catalogue our infrastructure.
ποΈ Architecture
From the internet edge to the kernel. Seven layers of defense, two bouncers, bidirectional threat intel, and a honeypot sidecar.
This entire defense infrastructure β from the Cowrie honeypot Dockerfile to the CrowdSecβMikroTik bouncer integration, from the Grafana dashboards to the AI-powered pentesting platform with 41 MCP tools β was architected, implemented, and deployed with GitHub Copilot as the primary engineering partner.
The Copilot agent debugged Kubernetes manifests at 2 AM, wrote the cowrie-to-loki pipeline, designed the tiered ban escalation logic, and built the stealth scanning framework that routes through Tor proxy.
Even this page was built by Copilot. It deserves the spot.