Skip to main content
Reyhford delivers real-time threat intelligence from a distributed honeypot network across Southeast Asia and beyond. Indicators are enriched with MITRE ATT&CK for ICS mappings, CVE context, and IP reputation before delivery.

​
What you get

TAXII 2.1 feed

STIX 2.1 bundles via standard TAXII 2.1 endpoints — compatible with any TAXII client.

Indicators REST API

Search and retrieve enriched indicators with filters for protocol, confidence, sensor type, and time range.

​
Architecture

Honeypot sensors → Pub/Sub → Pipeline → Enrichment → ClickHouse → API Gateway → You
LayerTechnology
IngestGCP Pub/Sub from edge honeypots (Conpot, Cowrie, Dionaea)
EnrichmentDeterministic MITRE/CVE mapping + IP reputation
StorageClickHouse
GatewayZuplo (api.reyhford.com) with API keys and WorkOS JWT
Feed formatSTIX 2.1 over TAXII 2.1

​
Base URL

All API requests use: 
https://api.reyhford.com

​
Support