Every dark port is a
sensor, trap, and witness.
DarkPort Enterprise turns your entire unused port surface into a full-spectrum detection grid — monitoring 65,535 ports, fingerprinting 27 protocols, and generating automated threat intelligence with zero false positives. Powered by DarkIP, our 1M+ dark IP global telescope that watches if your assets are compromised from the outside in.
an attacker's playground.
Traditional security monitors what you serve. Attackers probe what you don't. Every connection to a closed port is adversary reconnaissance — and you're ignoring all of it.
65,000+ Blind Spots
You run services on a handful of ports. The other 65,000+ are invisible to your SIEM, IDS, and SOC — yet attackers scan them systematically to map your infrastructure.
Silent Reconnaissance
Port scans generate kernel RST packets and vanish. No log entry, no alert, no evidence. Attackers complete full network surveys without triggering a single detection rule.
OT/ICS Exposure
Industrial protocols like Modbus, S7comm, DNP3, and BACnet are scanned daily by nation-states and botnets. Most OT environments have zero deception capability.
Manual Threat Intel
Correlating AbuseIPDB, GreyNoise, and GeoIP data manually is slow and error-prone. By the time you build a blocklist, the attacker has already moved laterally.
Alert Fatigue
Your IDS generates thousands of alerts on legitimate traffic. Meanwhile, connections to unused ports — which are 100% malicious by definition — go completely unmonitored.
Complex Deployment
Most deception platforms require Docker, Kubernetes, or cloud infrastructure. Deploying to hardened bare-metal servers in air-gapped or regulated environments is impossible.
high-fidelity sensor.
DarkPort Enterprise transforms your entire unused port surface into an intelligent detection grid that fingerprints, deceives, and generates actionable threat intelligence — automatically.
Full-Spectrum Port Monitoring
The DarkPort agent binds listeners on all 65,535 TCP ports, minus your known services. Every probe is captured, analyzed, and enriched — turning silence into signal.
RST Suppression27-Protocol Fingerprinting
Identifies the actual protocol spoken by the attacker — not just the port number. From SSH and HTTP to Modbus, S7comm, and OPC UA, DarkPort knows what they're really after.
IT + OT/ICS21 Protocol Emulators
Full interactive emulation keeps attackers engaged while capturing credentials, commands, and malware. Escalates to 6 backend honeypots for deep interaction.
Credential CaptureAutomated Threat Intelligence
Every IP is enriched in real-time with GeoIP (sub-ms), AbuseIPDB abuse scores, GreyNoise mass-scanner classification, and IPInfo network data.
4 Intel SourcesScan Pattern Detection
Four proprietary algorithms — Waterfall, Layer Cake, Sandcrawler, and Loom — identify distinct scanning methodologies and attribute them to known threat actor tooling.
4 AlgorithmsAutomated Blocklists
Three-tier blocklists regenerated hourly — Conservative, Recommended, and Extreme. Export as JSON or plain text. Direct import into pfSense, iptables, and Cisco ASA.
Hourly GenerationCross-Org Correlation
IPs observed attacking multiple organizations are correlated into a global threat feed, amplifying your intelligence with the entire DarkPort community's visibility.
STIX 2.1 FeedPort Rotation and Evasion
Periodic port shuffling with 7-day cooldowns defeats scanner fingerprinting. Attackers can't learn which ports are traps — because the traps keep moving.
Anti-Fingerprintin under a second.
A lightweight agent intercepts probes and escalates to backend honeypots. Events flow through mTLS-secured ingest, get enriched, and power your dashboards and blocklists.
One agent.
Future-proof by default.
DarkPort's modular architecture means new protocols, emulators, and honeypots plug in without touching the core engine. Your coverage grows as the threat landscape evolves.
Protocol Fingerprinting
27 today — no hard limit. Add new protocol signatures as simple pattern definitions. The fingerprinting engine matches against an extensible rule set, so emerging IT and OT protocols are a config change away.
Protocol Emulators
Each emulator is a self-contained module with a standard interface. Write a new emulator — for any proprietary or niche protocol — and drop it in. The agent auto-discovers and deploys it on the next cycle.
Backend Honeypots
6 production honeypots ship out of the box — SSH, HTTP, database, SMB, RDP, and OT/ICS. Need a custom honeypot for a proprietary service? Register it as a new systemd backend and the agent proxies traffic to it automatically.
IT and OT Coverage
From enterprise IT (SSH, RDP, databases, web) to industrial OT/ICS (Modbus, S7comm, DNP3, BACnet, IEC-104) — and everything in between. As new industrial protocols emerge or legacy systems need protection, DarkPort scales to cover them.
Zero manual effort.
Choose the aggression level that fits your risk tolerance. Every tier exports as enriched JSON or plain-text IP lists ready for direct firewall import.
High Confidence Only
Safe for automated blocking. Only IPs with overwhelming evidence of malicious intent make the cut.
Balanced Coverage
The sweet spot for most deployments. Catches active scanners and all honeypot-interacting IPs with minimal false positives.
Maximum Protection
Catches everything — including low-and-slow scanners that probe just a few ports per day to evade detection.
No containers required.
DarkPort deploys directly on Linux with a single setup command. No Docker, no Kubernetes, no cloud dependency. Perfect for hardened, air-gapped, and regulated environments.
Up to 50 Agents
PostgreSQL + Redis. All honeypots included. Ideal for single-site deployments.
Up to 500 Agents
Adds ClickHouse analytics engine. Multi-site visibility with deep historical queries.
Up to 10,000 Agents
Enterprise-scale fleet management. Full ClickHouse analytics. Rolling deployments.
Firewalls
pfSense, iptables, nftables, Cisco ASA
SIEM / SOAR
JSON API, STIX 2.1 threat feed, Prometheus metrics
Threat Intel
AbuseIPDB, GreyNoise, IPInfo, MaxMind GeoIP
Analytics
ClickHouse, PostgreSQL, 10-tab dashboard
DarkIP watches the internet.
Every DarkPort Enterprise customer gets automatic access to DarkIP — our global network telescope spanning 1,000,000+ dark IP addresses worldwide. If any of your organization's IPs are observed probing dark space on the internet, DarkIP flags it. No deployment. No sensors. Just ground truth from the outside in.
Inbound + Lateral Detection
Agents deployed on your hosts turn every unused port into a sensor and trap. Catches external attackers scanning in, and compromised insiders pivoting laterally.
Outbound + Reputation Intel
Our 1M+ dark IPs passively observe internet-wide traffic. When your org's IP addresses appear scanning this dark space, it means you have compromised hosts, active malware, or misconfigurations — and we alert you automatically.
1M+ Dark IP Telescope
We operate a globally distributed network telescope spanning over one million routed-but-unannounced IP addresses. No legitimate traffic should ever reach them — so every packet we capture is a signal of scanning, malware propagation, or misconfiguration.
Global InfrastructureCompromised Asset Alerts
When one of your organization's IPs is observed probing our dark space, it's a high-confidence indicator of compromise. DarkIP correlates the scan pattern, targeted ports, and timing to classify the threat — worm, botnet, or targeted reconnaissance.
Zero False PositivesOutbound Threat Visibility
Your firewall sees traffic leaving your network, but can't tell you if it's malicious. DarkIP can — because if your IP shows up scanning dark space, the intent is unambiguous. See what your perimeter tools miss.
Outside-In ViewMalware Propagation Detection
Worms and botnets scan the internet for new victims. Our telescope captures these scans in real-time. If a host on your network starts scanning, we see it — often before your own IDS does, because the scanning happens outside your perimeter.
Early WarningOrg IP Reputation Score
DarkIP continuously computes a reputation score for your organization's IP ranges based on observed scanning activity, protocol targeting, and frequency. Track your security posture from the attacker's perspective.
Continuous ScoreUnified with DarkPort
DarkIP alerts flow into the same DarkPort dashboard, blocklist engine, and STIX 2.1 feed. Correlate what attackers are doing to your network (DarkPort) with what your network is doing to the internet (DarkIP) — in a single pane of glass.
Single DashboardHow It Works — Nothing to Deploy
Register your organization's public IP ranges with DarkPort. Our telescope continuously monitors whether any of those IPs appear in dark space traffic. If they do, you're alerted instantly.
Built for automation.
The Control Plane API powers multi-tenant management for MSSPs and admins. The Dashboard API gives each customer deep visibility into their own threat data. Both are RESTful, Bearer-authenticated, and ready for integration.
Multi-tenant management API for MSSPs, SOC teams, and platform admins. Create organizations, manage agents, deploy fleet updates, and access cross-org threat intelligence.
Per-organization API for customers. Query events, honeypot interactions, threat intel, blocklists, traffic analytics, and alert rules — all scoped to your org.
?api_key= query parameter.
Linux and Windows.
Deploy agents with a one-liner, a PowerShell command, or a manual install. Each agent enrolls over mTLS, downloads its certificate, and begins monitoring all 65,535 ports immediately.
your attack surface.
Deploy DarkPort Enterprise in under 10 minutes. One script. Bare metal. Full-spectrum visibility from the first packet — plus instant access to DarkIP's global telescope monitoring your org from the outside in.
$ cd enterprise/deploy/bare-metal
$ sudo bash setup.sh --slug myorg --tier medium --email admin@example.com