SuckerPot v0.3.0

Changed

• just test-integration uses docker-compose.it.yml, an overlay that keeps redis on the backend network only, so the throwaway project fits in Docker's default address pools next to the live stack.
• The sidebar is grouped into ten entries. Related pages sit behind one entry with tabs: Attacks (Sessions, Attackers, Networks), Campaigns (Campaigns, Techniques), Tools (Scripts, Malware, Infrastructure), Trends (Activity, Patterns), Protection (Blocklists, Detections) and Exposure (Your exposure, CVE watch). Every old URL still works; /attackers?view=asns now redirects to /networks.
• Today is a visual story of the last 24 hours in plain words: a flow from country to service to how far each visit got, an hour-by-hour strip, and three to five stories of the day with their technical details one click away. Hard words have a short definition on hover.

Added

• VPN configuration upload (M23): Settings > VPN takes the WireGuard .conf from your VPN provider, parses it strictly (no PostUp and the like, IP endpoint only, full tunnel) after asking for the password again, and writes it to the new vpn-config volume. The vpn service notices the new file and restarts on it; nothing leaves outside the tunnel during the switch, and the API gets no Docker socket. A new exit address stays blocked until the owner trusts the /24 the gate observed (table egress_trusted_exits, migration 0020); an exit inside the honeypot's own addresses or in an AS listed in the new EGRESS_DENY_ASNS can never be trusted, and the exit's AS is shown next to it. /api/v1/settings/vpn endpoints, new guardrails.
• Anonymous reporting (M22): an ingest worker (ABUSE_REPORTS_ENABLED, off by default) finds abuse contacts over RDAP through the egress gate and prepares draft reports per recipient. The new reporting/ package renders plain text, X-ARF v0.2, .eml, STIX 2.1 and MISP JSON and builds password-protected sample bundles. An identity guard checks every artefact before it is returned and fails closed. Learned self terms need the owner's confirmation. The package ships no wording: the owner writes it in Settings > Reporting. Nothing is ever sent by the stack. Migration 0019, /api/v1/abuse endpoints, the Abuse reports page, Export for CERT, the sample bundle and the Reporting tab in Settings, just abuse-guard-check and the ABUSE_* settings.
• Anonymous egress (M21): a vpn service (WireGuard through gluetun, profile egress) with a kill switch and an HTTP proxy is the only container with a route to the internet. ingest and the new collector go through the proxy, an egress gate pauses outbound work when the tunnel or its exit address looks wrong, and the old egress network is removed. New just guardrails and just egress-check, new host firewall rules for sp-vpn, sp-egress and sp-samples.
• Payload collection and static analysis (M21): the collector service fetches captured download URLs through the VPN into a quarantine volume (SSRF validator, size, time and rate caps, never executed), and the network-less analyzer service identifies, hashes, scans with YARA, deobfuscates shell scripts and extracts C2 addresses in a limited child process. Migration 0018, roles suckerpot_collector and suckerpot_analyzer, the /api/v1/samples and /api/v1/egress endpoints, a Samples tab, a sample page and an Egress card in Settings. FETCH_PAYLOADS, PAYLOAD_MAX_BYTES and PAYLOAD_TIMEOUT_SECONDS are replaced by COLLECTOR_ENABLED and the COLLECTOR_* and QUARANTINE_* settings.
• Synology NAS sensor (M20): a fake unpatched Synology NAS on DSM 7.2.1 (Update 11), with the DSM login page and Web API on HTTP 5000 and HTTPS 5001. Logins always fail with real DSM error codes and are recorded. Requests that match the forged-session and SCGI shapes of CVE-2026-13639 and CVE-2026-13684 are tagged synology-exploit, ransomware indicators of the C3RB3R campaign are tagged c3rb3r, and DSM API calls are tagged synology-dsm. Migration 0017 adds the sensor to the inventory.
• Probable C2 lookups ignore VirusTotal contacts in big shared networks (Google, Cloudflare, Microsoft, Akamai, Fastly, Meta, Apple, from the local ASN database) and CDN or update domains, and clean up already stored rows on start.
• Probable C2 addresses: for file hashes that VirusTotal or abuse.ch already know, ingest reads which addresses sandboxes saw the malware contact (VirusTotal relationships, ThreatFox botnet_cc), with the same fixed hosts, quotas and 24 h cache as the other intel lookups and no contact with the addresses. New table indicator_contacts (migration 0016), GET /api/v1/indicators/c2, and a blocklist reason "probable C2" (75 for ThreatFox, 40 for VirusTotal, capped at 45 when no sensor computed the hash and fewer than three networks dropped it).
• GET /api/v1/story, the plain-language summary behind Today.
• A stage filter on GET /api/v1/sessions and on the Attacks page (looked, guessed, got in, ran commands, tried to install, sent an exploit), plus since and until in the Attacks URL.

Fixed

• The abuse, alerts and intel workers no longer wait up to an hour for their first run on a host that booted recently.
• CVE watch: the NVD window is 60 days (was 30) and is read in one-day chunks, oldest first, with a page budget, so a busy day no longer loses CVEs silently at the 10,000-result limit. A run that stops early resumes from its last complete chunk.
• CVE watch: GitHub advisories are read in seven-day chunks, oldest first. A one-time start-up rewind refills a shallow history, and watched CVEs that are missing from the table are fetched by id (at most 10 per run, once per id per 24 hours).

Docs

• A "Provider API keys" guide: what each optional key adds and how to get it, step by step.
• A Troubleshooting section in the deployment guide, and the upgrade command.
• Refreshed screenshots and a new README gallery for the three-space navigation.

Upgrade: git pull && just up (migrations 0017 to 0020 run automatically). See the deployment guide for the VPN, collector and reporting settings.

Full changelog: v0.2.0...v0.3.0