Fraud & account abuse
Investigate ad fraud and credential stuffing with captured requests and the proxy infrastructure behind them.
Helios
Capture the attack. Attribute its source.
Capture requests, TLS fingerprints, DNS activity, and commands across Synthient’s honeypot network. Trace credential stuffing, AI scraping, and botnet activity to the infrastructure behind it.
Follow the traffic.
Identify its source.
Trace a request to its proxy exit and provider. Correlate activity across targets and sessions using shared tunnel identifiers.
- Inspect the original capture
- Read request bytes, ClientHello fields, resolved domains, and command sequences.
- Add IP intelligence
- Look up the exit IP to see its network, location, and risk score.
One pivot
Helios captures live botnet traffic as it moves through a real proxy path.
AI scraping
Link repeated content requests across rotating proxy exits to investigate AI scraping.
Threat research
Study suspicious DNS activity and ADB commands to investigate botnet infrastructure and develop detections.
The capture,
field by field.
Inspect request headers, TLS handshakes, DNS destinations, and ADB commands. Follow the proxy metadata and session identifiers behind the traffic.
JSON record
{
"domain": "catalog.example.com",
"port": 80,
"protocol": "http",
"timestamp": 1781164692000,
"tunnel_id": 740057945,
"details": {
"method": "GET",
"uri": "/products?page=2",
"version": "HTTP/1.1",
"headers": {
"Host": "catalog.example.com",
"User-Agent": "python-httpx/0.28.1",
"Accept": "application/json"
}
},
"meta": {
"proxy_ip": "198.51.100.42",
"server": "gateway.example.com:7000",
"pool_id": "pool-eu",
"provider": "brightdata"
},
"raw": "GET /products?page=2 HTTP/1.1\r\nHost: catalog.example.com\r\nUser-Agent: python-httpx/0.28.1\r\nAccept: application/json\r\n\r\n"
}
Live captures.
Historical exports.
Receive captures as they arrive or query past activity by domain. HTTP, TLS, DNS, and ADB sensors are available separately.
Helios API referenceStream HTTP capturesShell
curl --fail --no-buffer \
"https://api.synthient.com/api/v4/feeds/helio/http/stream" \
-H "x-api-key: $SYNTHIENT_API_KEY"- Live streams
- Feed new captures into your detection pipeline as they arrive.
- Parquet exports
- Analyze hourly and daily snapshots in your warehouse.
- Domain lookup
- Find recent captures, subdomains, ports, and activity for a domain.
Sensor endpoints and required scopes
HTTP
/api/v4/feeds/helio/http/streamHONEYPOT_ HTTP_STREAM/api/v4/feeds/helio/http/export/{id}HONEYPOT_ HTTP_FEEDTLS
/api/v4/feeds/helio/https/streamHONEYPOT_ HTTPS_STREAM/api/v4/feeds/helio/https/export/{id}HONEYPOT_ HTTPS_FEEDDNS
/api/v4/feeds/helio/dns/streamHONEYPOT_ DNS_STREAM/api/v4/feeds/helio/dns/export/{id}HONEYPOT_ DNS_FEEDADB
/api/v4/feeds/helio/adb/streamHONEYPOT_ ADB_STREAM/api/v4/feeds/helio/adb/export/{id}HONEYPOT_ ADB_FEEDUse x-api-key for authentication. Export IDs accept latest or a daily date. See the feed reference for hourly IDs and metadata.
Evaluate Helios.
Request capture samples and access to the sensors you need.