# BadBot.net

> BadBot.net is an IP and domain reputation service. A worldwide network of honeypot sensors captures malicious activity (scanners, credential-stuffing bots and exploit probes) and converts it into time-decayed reputation scores, indicator correlation and downloadable high-risk feeds.

This site (badbot.net) is the public marketing site. The live application, API and data feeds are hosted at the Gateway: https://gateway.badbot.net/

## How it works (summary)

- **Sensor network:** Distributed honeypot sensors expose 60+ decoy "trap" endpoints (fake WordPress logins, exposed `.env`/`.git` files, cloud-metadata paths, admin panels, API specs). Legitimate users never request these, so any hit is a high-confidence abuse signal.
- **Behavioral classification:** Each request is profiled using signals such as scanner user-agents, request bursts, submitted credentials, hidden honeypot form fields, header anomalies, path traversal and API-spec follow-through. The event is mapped to an abuse category and a severity.
- **Escalation detection (what sets it apart from a basic honeypot):** The sensors are interactive (they serve believable fake admin/webmail logins and contact forms). They capture credential-stuffing and brute-force attempts (credentials hashed on-device, raw values never leave the sensor), catch contact-form spam via hidden honeypot fields, model control-panel and webmail attacks (cPanel, Plesk, Roundcube, phpMyAdmin, Jenkins, Tomcat), fingerprint fake browsers (browser user-agent but missing headers / no asset loads), and actively tar-pit attackers. Most importantly, they correlate each source over time, so a multi-step attack chain (e.g. robots.txt recon, then fetching an API spec, then hitting the advertised endpoints) is recognised as one escalating attack and scored higher than an isolated probe.
- **Time-decayed scoring:** Each abuse report contributes `severity × decay`, where `decay = 0.5 ^ (age_days / 14)` (exponential decay, 14-day half-life). Contributions are summed into a raw score, then mapped to a 0-100 display score via `100 × (1 − e^(−raw/10))`. Recent, severe and repeated abuse scores high; inactive indicators fade automatically.
- **Risk buckets:** Low (0-24), Medium (25-49), High (50-74), Critical (75-100).
- **Categories tracked (15):** Credential Stuffing, SMTP Abuse, Web App Attack, DDoS, Spam, Botnet Drone, Malware, Scanning, Phishing, Fraud, Web Probe, Config Exposure Probe, Web Stack Probe, Admin Panel Probe, API Probe.

## Marketing pages

- [Home](https://badbot.net/): The threat landscape, how the sensor network and scoring work, features and FAQ.
- [Contact](https://badbot.net/contact.html): How to reach us, including the email address (info [at] badbot [dot] net).

## Live application & API (separate host)

- [Gateway home / lookup](https://gateway.badbot.net/): Search any IP or domain for its reputation score, activity timeline and categories.
- [Threat feeds](https://gateway.badbot.net/feeds): High-risk indicator feeds in JSON, CSV and TXT.
- [API documentation](https://gateway.badbot.net/docs): Authentication, endpoints, feed parameters and examples.
- [OpenAPI spec](https://gateway.badbot.net/openapi.json): Machine-readable service description.
- [Correlation](https://gateway.badbot.net/correlate): Pivot across indicators via ASN, source overlap and sensor spread.

## Contact

- Email: info [at] badbot [dot] net for support, threat-data questions, partnerships, and abuse reports.

## Notes

- Reputation lookups, correlation, search and feeds are read-only and require no API key (subject to per-IP rate limits). An API key is only required for write operations such as submitting reports.
- Feed scores are time-decayed from reported abuse severity and recency.
- This product includes GeoLite2 data created by MaxMind (https://www.maxmind.com).