shuffle-on
Live 13 services · 31 scheduled jobs · one machine The Intelligence Engine · a SOC on one machine

Every packet that touches this lab ends up as evidence.

Sensors catch it. Enrichment explains it. An entity graph connects it. Campaigns emerge, dossiers get written and signed, and the worst offenders are blocked — for this lab and for the community. An investigation agent sits in the middle, one API or MCP call away from all of it.

Let's talk See it live
10,790Attackers profiled
692KGraph relationships
61KWeb senders profiled
813Campaigns (SSH + web)
817Dossiers published
54KActive blocks

Read from the live system · refreshed every 15 minutes

How it fits together

Six stages, one connected system.

Nothing here is a separate tool bolted on. Each stage feeds the next, and the agent can reach every one of them. Click a stage to see it in depth.

Sensors feed enrichment, which feeds the entity graph, campaigns, dossiers and collective defense; an investigation agent connects to every stage. SensorsSSH honeypotweb traffic sensors 557K sessions Enrichmentownership · reputationservices · geolocation 32K IPs enriched Entity graphnetworks · ssh keysmalware · domains 692K links Campaignscoordinated behaviouracross SSH and web 813 detected Dossierswritten, then signedverify page per dossier 817 published Defensecommunity blocklistrouter-level blocks 54K active Investigation agent enrich · correlate · attribute 41 tools · local models
data flowing between stagesthe agent's reach — any stage, on request
  1. SensorsSSH honeypot and web traffic sensors.557K sessions
  2. EnrichmentOwnership, reputation, open services, geolocation.32K IPs enriched
  3. Entity graphShared networks, keys, malware, contacts, domains, timing.692K links
  4. CampaignsCoordinated behaviour across SSH and web.813 detected
  5. DossiersWritten, signed, each with a verify page.817 published
  6. DefenseCommunity blocklist and router-level blocks.54K active
Under the hood

13 services, 31 jobs, one machine.

Long-running services answer in real time; scheduled jobs do the slow, patient work — enriching, linking, timestamping — around the clock.

Collect sense

  • Honeypot ingestion — every SSH session, login, command and download, as structured events.
  • Web sensors — every request to the public sites, the sender profiled and the intent classified.
  • Feed sync — community and open-source intelligence pulled in on a schedule.

Enrich explain

  • Quick enrichment — ownership, network, country and reputation for every new address.
  • Deep enrichment — multiple independent sources, cross-checked, for the addresses that matter.
  • CVE correlation — what a sender's exposed services are known to be vulnerable to.

Link connect

  • Intelligence linker — relationships by shared network, timing, abuse contact, domain, registrant and malware.
  • Entity graph — people, organisations and infrastructure resolved across 21 sources: ~1.58M entities, ~1.84M edges as of 14 Oct 2026
  • Vector memory — 26 collections, 1.29M vectors for search by meaning.

Attribute reason

  • Campaign detection — coordinated behaviour surfaced from noise, for SSH and web traffic.
  • Investigation agent — works a case end to end with its own tools and local models.
  • Entity resolution & search — 1,997 investigations, 4,156 actors on record.

Publish prove

  • Dossier publisher — investigations become readable, dated dossiers. Nothing is published without a human: the AI only proposes.
  • Evidence attestor — evidence hashed and timestamped; each dossier gets a signed verify page.
  • Reporter — weekly reports, alerting, provenance audits and the public live feeds.

Defend act

  • Block decisions — classified malicious addresses become time-boxed block decisions.
  • Shared with the community — decisions flow out to community detection, and its knowledge flows back in.
  • Enforced at the router — the confirmed worst are blocked before they reach anything.
Interconnected

At a click, an API or an MCP call.

The same intelligence, three ways in. A person browses it, a script queries it, an AI assistant uses it as tools — and they all see the same live data.

For people

The web interface

Dashboards for attackers, campaigns, the graph and the dossiers — and the public live feed and dossier index anyone can read.

For scripts

A REST API

Route groups for honeypot intelligence, web threats, the entity graph, investigations & findings, reports and agent chat with streaming — the same endpoints the dashboards and public feeds are built on.

For AI assistants

MCP tools

41 intelligence tools inside a lab-wide set of 445. Any MCP client — including lsn-agent-v3 — can call them.

Tool families

Grouped by what an analyst actually does, with approximate tool counts. Every call is logged.

Honeypot intelligence — sessions, credentials, commands, samples, campaigns, IOC feeds ~80
Dossiers & investigations — investigations, findings, evidence, cross-references, publishing ~45
Web threats — requests, hosts, campaigns, intent classification ~40
Intel & reporting — actor, network, CVE and country dossiers; summaries and exports ~35
Enrichment — reputation, ownership, DNS, certificates, bulk enrichment ~20
Entity graph — resolve, neighbours, paths, hubs, cross-links ~20
Defense checks — is it blocked, where, since when ~15
The investigation agent. Give it an address, a hash or a domain. It enriches it, walks the graph, checks whether the neighbours belong to a known campaign, drafts the dossier, cites what it found and checks the defenses — using the same tools, on local Qwen models with native tool calling on the llama.cpp router (AMD Radeon AI PRO R9700, 32 GB). No cloud: nothing leaves the machine for analysis. It proposes; a human decides what gets published.
One investigation, end to end

From one suspicious address to a signed dossier.

This is the path a single address can travel — every step a tool call, every step recorded.

  1. A login attempt lands on the honeypotThe session, credentials tried and commands are captured as events.
    sensors
  2. The address is enrichedOwner, network, country, reputation and exposed services — cross-checked across sources.
    enrich
  3. The graph finds its neighboursSame network block, same SSH key, same malware hash as addresses seen weeks earlier.
    graph
  4. It joins a campaignShared infrastructure and timing tie it to a coordinated group.
    attribute
  5. The agent drafts the dossierWhat happened, who is behind it, with every claim pointing at its evidence — then a human reviews and approves.
    write
  6. The evidence is sealedA signed Merkle root over the evidence, chained into an append-only log and timestamped; a verify page is published next to the dossier.
    attest
  7. The addresses are blockedThey become time-boxed block decisions, shared with the community and enforced at the router.
    defend

Illustration of the flow. Every stage is real and running; the order shows how one case can travel through it.

The full pipeline

Nine steps, from capture to defense.

The six stages above, at full resolution.

  1. CaptureSessions, credentials, commands, samples, web probes.
  2. NormalizeInto one knowledge base: relational, search and vector.
  3. ClassifyIntent and behaviour labels on every artifact.
  4. EnrichReputation, ownership, DNS, location, CVE context.
  5. ResolveInto the entity graph, conflicts tracked over time.
  6. InvestigateAgent and analyst build a sourced story.
  7. AttestEvidence sealed, signed and timestamped.
  8. PublishOnly after a human approves.
  9. DefendBlock decisions, shared and enforced.
The seal

How a dossier proves itself

One dedicated service holds the signing key, and nothing else does. When a dossier is published, it builds two tiers of evidence and seals both.

Public manifest

The evidence anyone can confirm, with sensitive indicators redacted — shipped with the dossier and its verify page.

Sealed evidence

The raw records, committed only as leaves of the Merkle tree — provably included, never published.

The signature

An Ed25519 signature over the Merkle root, chained into an append-only log and timestamped — the timestamp is later confirmed. Any reader can check the signature and integrity in their own browser, without trusting the server.

Proof, not promises

Read the output yourself.

The dossiers are public, dated and signed. The live feed refreshes every fifteen minutes. Nothing on this page is typed by hand except the words.

817Published dossiers, each with a verify page
24KEvidence records
692KRelationships in the graph
177Countries seen on the web side
A past highlight

TI-2026-013 — The Krane botnet

One of the early dossiers: a botnet traced from honeypot sessions to its shared infrastructure, with its evidence trail published alongside.

Read the dossier → · Check its verify page →

Work with me

Need intelligence like this for your organisation?

I design and run self-hosted security monitoring and threat intelligence — sensors, enrichment, graph, attribution and reporting — on hardware you own. Let's talk about what you need to see.

Let's talk on LinkedIn Browse the dossiers

Or email lisneanucristian@shuffle-on.com or lisneanucristian@gmail.com