· Live · BoarNet Mesh

Run a sensor. Get free Pro intel while it reports.

A passive honeypot you drop on a $5 VPS or homelab box. After the first scanner hits it (seconds), your account is promoted to Participant — JA3/JA4 fingerprints, ASN clusters, 90-day history. Two minutes to deploy. Open source agent.

59,884: IPs tracked
17: Live sensors
8: JA4s · 24h

Get a token →View source on GitHub ↗

30-second signup with email — no card, no phone, no domain claim. The token shows immediately on the next page. No host? Sponsor a sensor →

See it before you sign up

Look up an IP we've seen

Paste any source IP. If our sensors have observed it, you get the same response your sensor would receive from the API.

Paste any IPv4 to check it against our corpus.

· Deploy · 3 steps

From this page to live events in 2 minutes

Step 1

Sign up

30 seconds. Email + password, no card. Lands you on /onboarding with a token already minted.

Step 2

Copy your token

The /onboarding page shows your bn_… token once. Paste it as $BOARNET_TOKEN below.

What it looks like →

· Step 3 · Pick one stack

Docker Compose (recommended)

services:
  boarnet:
    image: ghcr.io/bino97/boarnet-agent:latest
    restart: unless-stopped
    network_mode: host
    environment:
      BOARNET_TOKEN: ${BOARNET_TOKEN}      # paste from /onboarding
      BOARNET_SENSOR_ID: ${HOSTNAME}
      BOARNET_INGEST_URL: https://www.boarnet.io/api/ingest/v1/events
    volumes:
      - boarnet-data:/var/lib/boarnet
volumes:
  boarnet-data:

Native binary

curl -fsSL https://boarnet.io/install.sh | sudo bash
# then on first run:
boarnet --token bn_<paste-from-onboarding> --fleet mesh

Docker is the safer default — the agent is sandboxed at the kernel level, no host-OS dependencies, auto-restart. Native binary is fine for VPS hosts where you control the kernel; egress is locked down to boarnet.io:443at the iptables level so the agent can't exfiltrate anything else.

Open source agent

Read every line that runs on your network. Build it yourself if you don't trust our binary. The repo is Bino97/boarnet.

What we collect

Source IP, destination port, payload bytes, JA3/JA4 hashes — only on the honeypot listeners. No traffic from your real services. Full schema in the API docs.

What you get

Free Pro API while a sensor is reporting: full JA4, per-sensor sightings, 90-day history, daily feed exports. Lapses to Observer 48h after your last heartbeat.

· Common questions

Will my IP get flagged on Spamhaus / AbuseIPDB?: The agent only listens — it never initiates outbound scans. Honeypot operators occasionally show up on score-based lists for inbound responses, but BoarNet sensor IPs are documented as research nodes; you can submit removal requests via the dashboard.
Can attackers pivot from the honeypot to my LAN?: If you run via Docker, the kernel namespace isolates the agent from the rest of your network. The agent's egress is also iptables-locked to boarnet.io:443 — even a 0day in the agent can't reach beyond that.
What happens if my sensor stops reporting?: Your account drops back to Observer tier 48 hours after the last heartbeat. No data loss, no surprise charges; bring it back online and you re-promote on the next event.
Don't have a host to run it on?: Sponsor a sensor for $19/mo — we run it for you in your chosen region, you get the same Pro access. See /sponsor for details.