Industrial-scale scanning
Botnets re-scan the entire IPv4 space in hours. Your obscurity is not a defense. Every open port is found, fingerprinted and catalogued automatically.
Live sensor telemetry · updated continuously
Know which IPs are hostile, before they reach you.
BadBot.net runs a worldwide network of honeypot sensors that catch scanners, credential-stuffing bots and exploit probes in the act. Every observation feeds a time-decayed reputation score, so you get intelligence that's both accurate and current.
Free, read-only lookups & feeds · No account required · JSON · CSV · TXT
60+
Honeypot trap types
14-day
Score half-life
15
Abuse categories tracked
0-100
Threat score scale
The rise of bots
A growing share of all web traffic is automated, and much of it is hostile.
The moment a server gets an IP address, the probing begins. Automated crawlers sweep the
entire internet around the clock, hunting for a forgotten .env file, a reused
password, an unpatched plugin or an exposed admin panel. What used to be the work of skilled
attackers is now commodity automation: cheap, relentless and global.
Credential stuffing at scale
Billions of leaked username/password pairs get replayed against login forms day and night. One reused credential is all it takes for an account takeover.
Exploits within minutes
A newly disclosed vulnerability is being mass-exploited before most teams have read the advisory. Speed of detection is now the whole game.
You can't out-staff a botnet. The only thing that scales against automation is better data: knowing, in real time, which addresses are already behaving badly elsewhere. That's exactly what BadBot.net is built to provide.
How the sensor network works
Traps that only a bot would touch.
Our sensors are decoys with no legitimate purpose. Because a real visitor would never request them, every interaction is a high-confidence abuse signal: captured, classified and scored within a single pipeline.
Deploy sensors
Lightweight honeypot sensors run across multiple regions and networks, each exposing 60+ trap endpoints that mimic a real, vulnerable web stack.
Catch the probe
A bot requests a fake /wp-login.php, /.env, /.git/config or cloud-metadata path. The sensor records who, what and how, and tar-pits the connection.
Classify behavior
Signals like brute-force bursts, captured credentials, spam-trap fields and fake-browser fingerprints map each hit to an abuse category and severity, correlated per source to reveal escalation.
Score & publish
Events stream to the gateway as abuse reports, the indicator's reputation is recomputed with time-decay, and the result appears in lookups, correlation and feeds.
What the traps look like
Decoy endpoints span the paths attackers love most. A request to any of them is essentially a confession.
/wp-login.php
/.env
/.git/config
/wp-config.php.bak
/.aws/credentials
/admin
/actuator/env
/latest/meta-data/
/swagger.json
/.well-known/openid-configuration
/v2/_catalog
/phpMyAdmin/
/cpanel
/webmail/
/roundcube/
/manager/html
Behavioral signals we read
Beyond the path, each request is profiled. These signals raise severity and tell automated traffic apart from a curious human.
scanner user-agent
request bursts
credential submission
hidden honeypot field
header anomalies
path traversal
API-spec follow-through
destructive methods
Not your average honeypot
We detect the escalation, not just the knock.
A dumb honeypot logs that someone rattled a door. Ours are interactive decoys that watch what happens next, correlating each source's moves over time to surface real, escalating attacks.
Credential stuffing & brute-force
Our fake admin and webmail logins capture the username and password pairs bots throw at them, hashed on the sensor so raw credentials never leave the box. Rapid repeat attempts are flagged as brute-force bursts.
Contact-form & spam abuse
Hidden honeypot fields sit invisibly inside our forms. A human never sees them; a spam bot fills them in and outs itself the instant it submits.
Control-panel & webmail attacks
Decoys for cPanel, Plesk, webmail and Roundcube, phpMyAdmin and app consoles like Jenkins and Tomcat catch the hosting-panel takeover attempts most honeypots never model.
Multi-step escalation
We correlate each source's moves over time: robots.txt recon, fetching an API spec, then hammering the very endpoints it advertised. That is an attack chain, and we score it as one.
Fake-browser fingerprinting
A "browser" that omits Accept-Language or Sec-Fetch headers, or never loads a single stylesheet or image, is headless automation in a costume. The mismatched fingerprint gives it away.
Active tarpitting
The more dangerous a visitor looks, the longer every response takes. We deliberately waste attacker time while logging exactly what they tried.
Scoring with decay over time
Recent abuse counts most. Old abuse fades.
Every abuse report carries a severity (how serious) and a timestamp. Instead of counting reports forever, BadBot weights each one by an exponential time-decay factor with a 14-day half-life.
# weight of one report, by age in days
decay = 0.5 ^ (age_days / 14)
# raw score = sum of severity × decay, over all reports
raw = Σ ( severity × decay )
# mapped to a 0-100 display score
score = 100 × ( 1 − e−raw / 10 )
decay = 0.5 ^ (age_days / 14)
# raw score = sum of severity × decay, over all reports
raw = Σ ( severity × decay )
# mapped to a 0-100 display score
score = 100 × ( 1 − e−raw / 10 )
A report counts fully on day 0, half as much after 14 days, a quarter after 28, and so on. Many fresh, severe reports push an indicator toward 100; a single old report barely registers. The result is a self-cleaning score: when an IP stops misbehaving, it drifts back down on its own: no manual expiry, far fewer stale false positives.
- Recency-aware: yesterday's attack outweighs last quarter's.
- Severity-weighted: credential stuffing outranks a single port scan.
- Self-expiring: reassigned or remediated IPs cool off automatically.
Report weight over time
Exponential decay · 14-day half-life
Low
0-24
Medium
25-49
High
50-74
Critical
75-100
What you can do with it
Built for security and operations teams.
Reputation lookups
Query any IP or domain for its current score, activity timeline, category breakdown and ASN/WHOIS enrichment.
High-risk feeds
Pull deny-lists in JSON, CSV or TXT, or grab full IPv4/IPv6 snapshots for firewalls, SIEMs and edge filters.
Indicator correlation
Pivot from one IP to related infrastructure via shared ASN, overlapping report sources and sensor spread.
Documented API
Read-only REST endpoints, OpenAPI 3 description and an LLM-friendly site index for tools and AI agents.
Self-cleaning data
Time-decay keeps the dataset honest. Stale indicators expire on their own, so blocklists stay lean and trustworthy.
Global vantage point
Sensors in different regions and networks see attacks you wouldn't: first-party telemetry, not recycled lists.
Questions, answered
Frequently asked questions
What is BadBot.net?
BadBot.net (also known as BadBot Gateway) is an IP and domain reputation service. It aggregates abuse observations from a worldwide network of honeypot sensors, applies time-decayed scoring, and exposes the results through a simple API, a lookup UI and downloadable high-risk feeds in JSON, CSV and TXT formats.
How does the honeypot sensor network work?
Sensors are deployed across multiple regions and expose dozens of decoy endpoints: fake WordPress logins, exposed .env and .git files, cloud-metadata endpoints, admin panels and API specs. No legitimate user ever requests these paths, so any hit is a high-confidence signal of automated abuse.
Each sensor classifies the request using behavioral signals (scanner user-agents, request bursts, submitted credentials, hidden honeypot fields, header anomalies and more), tar-pits the connection, and streams the event to the central gateway as an abuse report.
How is this different from an ordinary honeypot?
Most honeypots just log that an endpoint was touched. Ours are interactive decoys that detect escalation. They serve believable fake admin and webmail logins and capture credential-stuffing and brute-force attempts (hashing credentials on the sensor, so raw passwords never leave it), catch contact-form spam via hidden honeypot fields, and model control-panel and webmail attacks (cPanel, Plesk, Roundcube, phpMyAdmin, Jenkins, Tomcat).
Most importantly, they correlate each source over time. A recon scan that reads robots.txt, fetches an API spec, then hits the very endpoints it advertised is recognised as one escalating attack chain, fingerprinted as headless automation, and scored far higher than an isolated probe.
How is a reputation score calculated?
Every abuse report contributes its severity multiplied by a time-decay weight. The decay is exponential with a 14-day half-life, 0.5 ^ (age_days / 14), so a report counts fully today, half as much after 14 days and a quarter after 28.
The weighted contributions are summed into a raw score and then mapped onto a 0-100 display scale via 100 × (1 − e^(−raw/10)). Fresh, severe and repeated abuse scores high; quiet indicators stay low.
Why does the score decay over time?
IP addresses are frequently reassigned, and compromised hosts get cleaned up. Time-decay means an address that stops misbehaving naturally drifts back toward a low score without any manual intervention. That reduces false positives and keeps the feeds current and trustworthy.
What formats are the threat feeds available in?
High-risk indicator feeds come in JSON (structured records), CSV (for imports and quick review) and TXT (one indicator per line for firewalls, deny-lists and SIEMs). Pre-generated full IPv4 and IPv6 snapshots are also available for bulk ingestion. You can tune min_score and limit to match your risk tolerance.
Do I need an API key to read reputation data?
No. Reputation lookups, correlation, search and the high-risk feeds are read-only and require no API key, subject to per-IP rate limits. An API key is only needed for write operations such as submitting your own abuse reports.
How do I report an abusive IP or get in touch?
Email info [at] badbot.net for support, data questions, partnerships or to report abuse. The contact page has more detail.