Sensor Network
6 sensors, 12 emulated services each
BlackDome runs 6 sensors. Each sensor runs the same 12 emulated services. Sensor addresses are not published, so the sensors stay useful.
Locations
Where the sensors run
| City | Country | Hosting |
|---|---|---|
| Sydney | Australia | DigitalOcean cloud VM |
| Helsinki | Finland | Hetzner cloud VM |
| New York | United States | DigitalOcean cloud VM |
| London | United Kingdom | DigitalOcean cloud VM |
| Bangalore | India | DigitalOcean cloud VM |
| Toronto | Canada | DigitalOcean cloud VM |
Services
What each sensor emulates
| Port | Service | Persona | Captures |
|---|---|---|---|
| 22 | SSH | Ubuntu 22.04 server with an interactive shell | Logins and credentials, shell commands |
| 23 | Telnet | Legacy NAS | Logins and credentials, shell commands |
| 21 | FTP | vsftpd file server | Logins and credentials, FTP commands |
| 25 | SMTP | Corporate mail server | SMTP commands (EHLO, VRFY), login attempts |
| 53 | DNS | Corporate internal DNS | DNS queries, including suspicious queries |
| 80 | HTTP | Admin panel | Requests, client fingerprints, login attempts, exploit (CVE) probes, uploaded files |
| 443 | HTTPS | Admin panel (TLS) | Requests, client fingerprints, login attempts, exploit (CVE) probes |
| 445 | SMB | Finance domain controller | Connection and SMBv1 probes |
| 3306 | MySQL | MySQL 5.7 database | Logins and credentials, queries |
| 5432 | PostgreSQL | Application database | Login attempts and credentials |
| 6379 | Redis | Redis 6 cache | Commands, including exploitation payloads |
| 27017 | MongoDB | Application data store | Database commands |
What we capture
- Connection metadata on every service.
- What each service can carry, listed per service above: credentials where the protocol has logins, commands and queries, and exploit attempts.
- Files and payloads that attackers upload or reference are stored as evidence. Some are detonated in an isolated sandbox; detonation does not yet cover every payload.
- Everything is tied to the session that produced it.
What we filter
Scan-only traffic is rate-limited and summarised. Above 120 events per source IP per minute, further events are counted, not stored individually.
How indicators are published
- Timestamps are in UTC.
- Each IP indicator records first seen, last seen, and how many sensors saw it.
- IP indicators expire 30 days after last seen. Domains and URLs expire 90 days after last seen. File hashes never expire.
- Indicators are exported as STIX 2.1 over TAXII 2.1, so MISP and similar platforms can pull them.
- A redacted, delayed preview is public at /intel; its Sensors column shows how many sensors saw each IP.
Known gaps
Research scanners, for example Shodan or Censys, are not yet tagged by name.