Help the network

Three commands. No dashboard. No VPN needed.

Want to help and nothing else? Run the sensors on a spare machine, open the ports the installer prints, and you are in. Choosing this mode is your consent to join the SuckerPot network.

shell

git clone --depth 1 --branch v0.7.1 https://github.com/selfhostr/suckerpot.git
cd suckerpot
./scripts/install.sh --participant

Replace v0.7.1 with the release you want. SuckerPot is built to be attacked: use a dedicated machine that holds nothing else you care about.

What you need

A small Linux machine and a router you control.

Sensors, database and the network node only, in about 2 GiB of memory.

Machine	A Linux VM or small server, x86_64 or aarch64, with 2 GiB of memory or more and 15 GiB of free disk.
Software	Docker Engine 24+ with the Compose plugin, git, curl and Bash 4+. Your user must run docker without sudo.
Router	You can forward ports to this machine.
VPN	Not needed.

What you agree to share

Attacker facts, in aggregate. Never yours.

The installer prints what it will share and asks one question before it joins. With --yes it does not ask, and that counts as your consent.

The addresses that attacked your sensors, with the service they used, what they did and rounded counts. Once a day, a few hours late.
Download links attackers tried, as hashes. The clear link goes to the hub only when two or more sensors saw the same link.
Malware hashes and command-and-control addresses, but only if you have a VPN and the collector is on.
Never passwords, commands, your ports, your own address or any name of yours.

The full picture, with the threat model, is on the network page.

Open the ports

Your only job after the install.

The installer ends with a table of router ports and the ports on your machine. Forward each router port to this machine. Never forward your own admin SSH port. The installer never edits your SSH settings.

Router port	This machine	Protocol	Sensor
22	22	TCP	ssh
23	23	TCP	telnet
80	80	TCP	web
443	443	TCP	web

Example of what the installer prints. If port 22 is busy on the machine, the SSH sensor uses 2222.

Privacy without a VPN

The hub sees an address. It does not keep it.

Without a VPN, the hub sees your home address when your machine connects. A tunnel provider in front of the hub sees it too. The hub does not store it and does not log it, but the address is not hidden.

Only one small service has a route out in this mode. It forwards connections to the hub host and nothing else.
The ingest service, which parses attacker data, has no route out. Your sensors never download anything.
Add a VPN any time: ./scripts/participant.sh vpn /path/to/wireguard.conf.

Stay in control

Check it, update it, leave any time.

Command	What it does
./scripts/status.sh	Shows the sensors and their ports, your standing, the last contact with the hub and what was sent each day.
./scripts/participant.sh leave	Leave the network. The sensors keep running.
./scripts/participant.sh join	Show the consent again and join.
./scripts/participant.sh vpn FILE	Send everything through your VPN.
./scripts/participant.sh auto-update off	Turn the daily update schedule off.
./scripts/participant.sh uninstall	Leave, stop the stack and remove the schedule. It prints the command that removes data and never runs it.

Automatic updates

Signed releases install themselves once a day, at least 48 hours after they are published, and only within the same major version. A database dump is taken first. If an update fails, the previous version is restored. If the release channel were ever compromised, auto-updating participants would be affected: the signature and the delay reduce that risk, they do not remove it. One command turns updates off.

Verifier nodes

Most participants never download malware. A verifier is an opt-in node with a VPN and the collector that can fetch a link two nodes reported and describe the file. It also needs a role from the hub operator.

Switch to full mode

./scripts/install.sh --full adds the dashboard and keeps your data and membership. The other way, full to participant, is not supported. See Install.

Read the full guide How the network works