IPs are scanning your infrastructure right now. The question is whether you know it.
An attacker doesn’t enter where the firewall blocks. They enter through what the firewall doesn’t know exists, forgotten ports, exposed services, credentials tested in silence.
Heimdall deploys traps that look like real systems. Any IP that touches them is logged, classified, and analyzed in real time. Not reactive detection, active intelligence on who’s watching you before they find anything real.
false positives, if it touches the trap, it’s an attacker. No exceptions.
attack types classified: EXPLOIT · BRUTE · PORTSCAN · SCAN · BOT · RECON · HUMAN
autonomous monitoring, attacks don’t wait for business hours
Deceive to detect. Detect to protect.
Heimdall operates on a principle that traditional detection systems can’t replicate: any interaction with the traps is evidence of malicious activity. No thresholds to tune, no false positives to review.
Traps deployed
HTTP/HTTPS login pages designed to look like real systems, TCP trap ports, and services that simulate production infrastructure. No legitimate user ever touches them because they aren’t part of normal operations.
Contact = immediate alert
Any IP that interacts with a trap is logged instantly, with timestamp, attack type, captured payload, and geolocation. The event appears on the dashboard in under one second.
Automatic classification
Heimdall’s engine determines the threat type: port reconnaissance, credential bot, web vulnerability scanner, or brute-force attack. Every event is labeled without human intervention.
Actionable intelligence
Threat score per IP, complete activity history, geographic data, and behavioral profile. You know exactly who’s watching you, from where, and what they searched for in your infrastructure.
Visibility you didn’t have. Intelligence you didn’t expect.
Every component of Heimdall exists so no IP that probes you goes unnoticed, from the first TCP packet to the credential attempt.
HTTP/HTTPS honeypots
Login portals that look like real systems, control panels, VPN access, corporate intranets. Any IP that attempts to authenticate is logged with the credentials it tried, the timestamp, and the user-agent. The attacker thinks they failed. You know exactly what they attempted.
TCP trap ports
Ports that listen without running real services. Any TCP connection on those ports generates an immediate PORTSCAN or RECON alert, a signal that someone is actively mapping your attack surface. Configurable across any port range with no risk of affecting production services.
Real-time dashboard
Event table updated in real time with geolocation per IP, activity heat map, and unique IP counter for the last 24 hours. Events arrive in under one second via WebSocket, no reload, no polling. Designed for continuous monitoring in a security operations center.
IP profile and threat score
Each attacking IP has its own dossier: threat score calculated by event type and intensity, all historical events in chronological order, country and city of origin. One click on any IP in the table opens the full panel. Nothing is lost, history is permanent.
Configurable trap templates
The fake portal the attacker sees is fully customizable from the dashboard, logo, text, login appearance, error message. No code required. You can build a trap that simulates exactly the system you want to protect, or design a generic one that attracts any type of reconnaissance.
2FA-protected dashboard
The Heimdall dashboard itself uses JWT + TOTP two-factor authentication, role-based access control, per-IP rate limiting, and automatic lockout after 5 failed attempts. A security system that isn’t secure itself isn’t a security system.
Interactive protocol traps
Beyond the port that only listens, Heimdall answers like a real FTP, SMTP or SSH service and lets the attacker try. It records the usernames and passwords they attempt, the commands they type and what they were after, in a fully isolated environment: mail is never relayed, FTP never touches disk, and the fake SSH shell executes nothing. You learn the attacker’s method without giving them anything.
World attack map
Events land on a world map, live and without depending on an external service. It is the screen you leave projected, and the one that makes anyone looking at it understand in ten seconds the volume of what hits the infrastructure every day.
Email alerts and block feed
When an IP crosses the threshold you configure, Heimdall emails an alert with the detail of what it did. It also publishes a feed of addresses to block, in the format the firewall consumes on its own, so detection turns into blocking without anyone copying a list by hand. An allowlist keeps your own traffic out so the record stays clean.
Enrichment of every IP
For every address that touches a decoy, Heimdall finds out which provider it belongs to, whether it is already reported for abuse, whether it is a Tor exit node and whether it appears on known malicious infrastructure lists. What the world already knows about that IP is added to the score of its observed behaviour.
This is what your team sees while the attackers do not know they are being watched.
Twenty-six seconds of an actual walkthrough, on our own honeypot exposed to the internet: the live feed, the event history, the world map of attack origins, the report with its automatic verdict, and an IP profile with its behaviour score and threat intelligence.
Click here and request a live demo with our team. We walk you through the whole system, module by module, with your own scenario on the table, answering anything you want to ask.
A decoy has no legitimate users. Nobody has a reason to be there, so every recorded event is, by definition, someone who should not be. That is the difference with a SIEM, where the work is separating noise from what matters.
Reconnaissance, scanning, brute force, exploitation, crawler, academic research, or a real person behind the keyboard. The distinction matters: a research scanner and an exploitation attempt do not deserve the same reaction, and confusing them is what makes people switch alerts off.
Reputation, ASN, whether it is a Tor exit node, whether it appears on command and control lists, and the history of what it tried. The behaviour score comes from how it acted against the decoy, not only from what public lists say.
The geographic origin of every attempt, live. It covers what a dashboard of numbers cannot explain in a board meeting: the scale and the persistence of what knocks on the door every single day.
Events for the period, unique IPs, share of automated traffic, exploitation attempts, and the addresses that need attention with their verdict. It is the material that carries a conversation with leadership without having to translate logs.
The most aggressive addresses are published in a feed that a firewall, nginx or fail2ban consumes directly. The decoy stops being a curiosity and becomes a blocking source built on your own data, not someone else’s.
What a SIEM can’t replicate. What a firewall can’t do.
Traditional detection systems look for anomalies in legitimate traffic, which is why they generate noise.
Heimdall has no legitimate traffic to analyze. Any interaction with the traps is an attacker. No thresholds to calibrate, no rules to update, no false positives to discard.
Every alert is real intelligence, specific to your infrastructure.
noise, only events from real malicious actors
from your own network, not generic third-party feeds
reconnaissance, you detect the attacker before they find anything real
The first step of any targeted attack is reconnaissance. Heimdall catches it there.
IDS and SIEM detect attacks that already passed your defenses. Heimdall catches malicious actors while they’re still exploring, while you can still act.
Detection at reconnaissance phase
An attacker scans before they exploit. Heimdall catches them at that moment, before they find a real vulnerability in your production stack.
No rules to maintain
IDS require constant signature updates. Heimdall works with a simple axiom: any contact with the trap is malicious activity. No exceptions.
Intelligence from your own environment
Threat intel feeds are generic. IPs captured by Heimdall targeted your infrastructure specifically, that’s information no external vendor can give you.
Integrated AllSafe ecosystem
IPs captured by Heimdall can be investigated directly in Gjallarhorn with 20+ threat intelligence sources. From trap to full investigation in seconds, without switching tools.
Deploy Heimdall in my network
Fill out the form. An AllSafe specialist will contact you to assess your architecture, design the most effective trap layout for your environment, and get the system operational.
Sabías que existe Heimdall Community?
Versión gratuita y open source (AGPL-3.0) con el honeypot completo: cinco señuelos intercambiables, dashboard en tiempo real, clasificación automática de ataques y trampas TCP. Todo lo que necesitás para empezar a capturar inteligencia de amenazas reales.