TCP Services
Standard endpoints
- Predictable, banner-mimic responses for common TCP traffic.
- Session timing captured; payloads retained privately.
- Only protocol-correct talk-back; no scans or outreach.
Nodes accept whatever arrives—tunnels, mail, commodity services, and background noise. We only talk back when protocol completion requires it (e.g., P2P tracker replies, mail handshakes). Intake is stored and reported as aggregated, anonymized data for research and defensive analysis.
Controlled endpoints that quietly collect unsolicited traffic for protocol research and abuse mapping. No active scanning, probing, or outbound sequencing is performed from these nodes.
Surfaces we expose
TCP Services
UDP Services
Mail & Tunneling
Aggregation
Outputs are rolled-up counts, timings, and protocol summaries. Raw captures remain internal.
Posture
Nodes accept inbound traffic and respond minimally for protocol completion. No scanning, seeding, or outbound probing.
Access
Provide ASN/use case and desired surfaces. Approved requests receive a static summary drop.
These nodes are maintained for protocol research, threat intelligence enrichment, and defender training. Services emulate ordinary endpoints to avoid undue attention while preserving inbound artifacts for later analysis. Data is never used to initiate new communication back to origin sources beyond required protocol completion.