Anonymity by design
Your home address never leaves first.
Attackers already know the address they hit. Nothing else should learn it from you. So every outbound connection takes one road, and that road has a gate.
The only road out
An identity check, then a VPN with a kill switch.
Lookups, payload fetches and abuse reports leave the machine one way. Everything else has no route out at all.
Your machine
- lookups
- payload fetches
- abuse reports
Identity check
Refuses any text that names you, your address, your host or the project.
VPN + kill switch
Tunnel down means nothing leaves. DNS goes through it too.
Internet
Sees the VPN exit, not you.
- Only one container can reach the internet: the VPN client. A test in CI checks this on every change.
- Reports carry facts only: times, addresses, commands, URLs, hashes. Wording is optional.
- You review each report. Send it from your own anonymous mailbox, or let SuckerPot send it through the tunnel.
$ check report-7f3a.eml body 2 URLs, 1 hash ok headers neutral ok line 12 names this host stop refused: nothing was sent
Abuse reports
Drafts you read, copy and send.
SuckerPot finds the abuse contact of each attacker, payload host and C2 server, and drafts a report. By default nothing is sent for you.
- The identity check card comes first on every report. It says what was masked, or why the report is blocked.
- Formats: plain text, X-ARF and .eml, with copy buttons and downloads.
- Export for CERTs as STIX 2.1 or MISP JSON, with a TLP choice.
- Replies can be read from a dedicated mailbox, sorted and linked to the report they answer. Optional.
- Demo reports carry a “Demo data, do not send” banner and cannot be marked sent.
- No counter-scans and no automatic reporting to AbuseIPDB. SuckerPot only reads it.
Honest limits
One thing a report cannot hide.
A report carries times and ports. The attacker’s network could match them with its own logs to find the address that was attacked. The attacker already knew that address, so nothing new is learned about you. The installer itself, which pulls signed images from a registry, uses your own address. Once a VPN is configured, everything SuckerPot sends out after the install goes through the tunnel.
Participant mode can run without a VPN. Then the hub, and the tunnel provider in front of it, see your home address when your node connects. The hub does not store it. You can add a VPN at any time. See Participate.
Next