live attack feed — real honeypot telemetry …
hits today
··
total captured
··
top ports
—
sanitized — attacker IPs stripped · feeds from fenris02 opencanary + tripwire choke · simulated lines marked [simulated]
network — default-deny firewall sim
toggle the policy and watch the probe traffic react — same posture as the real fleet: only the tunnel and 80/443/8080 pass.
WAF lab — Cloudflare-style rules
block bad bots
UA fingerprint · scanners, nuclei, go-http
rate-limit /login
burst > 8 req/60 s
challenge suspicious
credential-stuffing patterns → managed challenge
push protocol — encrypted mesh delivery
🔐encrypt
✍️sign
📡relay
✅verify
🗄️archive
DR reflash — restore pipeline
📸capture
📦age-seal
📋manifest
♻️restore
fleet monitor — live nodes …
tunnels
external sites
passkey vault — real WebAuthn, no passwords
checking session…
This is the same passwordless flow the site's admin console uses — device-bound FIDO2 credential, challenge-response verification, nothing but a public key stored server-side. Face ID / Touch ID / Windows Hello / hardware key all work.