News for hackers. Stuff that matters.

Robbedoes

Robbedoes on Hacker News

Re:Show HN: Spip – Open-Source Self-Hosted TCP Network Sensor on Friday February 06, 2026 @04:47AM (#46910892)
Good suggestion. To be honest, Cgo was the easiest for me to implement, as I originally wrote the tool in a different language. Also, most of the documentation for Netfilter and SO_ORIGINAL_DST is in C.

As for results: I’m seeing about one 'hit' per second on a standard VPS. It's a constant stream of bots looking for exploitable systems and probes from scanners like Shodan and Censys. It’s actually surprising how quickly a new IP gets picked up by these crawlers.

Show HN: Spip – Open-Source Self-Hosted TCP Network Sensor

Posted by Robbedoes on Friday February 06, 2026 @04:25AM
from the show-hn dept.

https://github.com/StefanGrimminck/Spip-Go

Spip is a lightweight, low-interaction network honeypot sensor. It listens for arbitrary incoming TCP traffic (plain and TLS), captures what scanners and bots send, and logs each connection as structured JSON (ECS-shaped) for easy ingestion into your SIEM or data lake.

( Read More... | 2 comments | 3 points | on HN )
Re:Building a threat intelligence feed using the Twitter API and a bit... on Monday May 30, 2022 @05:39AM (#31557156)
It seems this is only the case if it's a tweet that contains a retweet. These are now removed from the stream as they're not of relevance.
Re:Building a threat intelligence feed using the Twitter API and a bit... on Sunday May 29, 2022 @09:25AM (#31548956)
Am a fan of your work! Would it be useful if I throw these domains directly to URLScan? For retrieving the results I'll probably have to setup a proper DB and a workflow around parsing the Twitter content. Now, it's just a simple script.
Re:Building a threat intelligence feed using the Twitter API and a bit... on Saturday May 28, 2022 @10:09PM (#31545615)
Thanks!
Re:Building a threat intelligence feed using the Twitter API and a bit... on Saturday May 28, 2022 @09:34PM (#31545435)
Interesting! Will have a look on what they can freely offer.
Re:Building a threat intelligence feed using the Twitter API and a bit... on Saturday May 28, 2022 @09:34PM (#31545428)
Plan in the future is to visit the links, download malware and upload it to VirusTotal, Malwarebazaar, etc.