Threat intelligence from attacks we actually catch
huntback, formerly Lupovis, is a deception-led threat-intelligence platform. Our research comes from our own decoy network and from scanning the infrastructure that attacks it, not from recycled feeds.
Decoys, counter-recon and exposed open directories
A fleet of internet-facing decoys runs across several cloud providers and networks, so attackers meet it the way they meet real targets. Each decoy emulates a product people actually run. Because decoys have no legitimate users, every request they receive is hostile, and every request is matched against our exploit signatures on the backend.
When something interesting lands, huntback scans the source infrastructure back: open ports, TLS and JARM fingerprints, certificates, passive DNS and any directory the operator left open. Files harvested from exposed attacker directories are analysed privately; public pages show file names only, with victim-identifying names redacted, and never file contents.
- First-party captures, not aggregated reputation
- Every indicator tied to the evidence behind it
- Aggregate, network-wide data only on public pages
- No customer data in research or public pages
decoy capture tagged → source scanned back
open directory harvested → pivots on JARM, certs, DNS
analysis → published with IOCs
Research, live data and permalinks
Research posts
Dated, first-party investigations with key findings, timelines, indicators and ATT&CK mapping.
CVE intelligence
A permalink per CVE with exploitation seen on the decoy network, EPSS and CISA KEV status.
Live finds
Confirmed malware hosts, C2 servers and exposed open directories, with IP and JARM permalinks.
Citing and using huntback research
How should I cite a huntback post?
Link the post's canonical URL on huntback.io and give its publication date, which is shown under the headline. Posts keep stable URLs.
Can I use the indicators?
Yes. Indicators in posts are defanged for safety; research posts with an indicators section also link a machine-readable CSV of the same indicators.
Where is the data from?
From huntback's own decoys and scanners. Public pages show aggregate, network-wide intelligence only and never customer data.
I am a researcher. Can I get access?
Yes. The Research Partner programme gives free research access at Advanced limits for 12 months in return for crediting huntback in published work.
Do you have a feed?
Yes: an Atom feed of new research at huntback.io/blog/feed.xml, and a summary for AI assistants at huntback.io/llms.txt.
Hunt with the same data
The pivots in every post are live in huntback, free to start.