From zero to first bait in minutes.

Quick start (free)

1. Create your account at app.silentbait.io/register — work email + password. No credit card, no plan choice.
2. Verify your email with the 6-digit code we send you (check spam — the sender is noreply@silentbait.io).
3. Run a Threat Lookup: any IP or account, checked against everything our capture network has seen. 5 lookups included on the free tier.

Hosted baits (we run them for you)

Hosted baits are fully managed honeypots on SilentBait infrastructure, deployed from the Deception → Baits page in the console.

The four bait types

• Okta clone — a byte-authentic Okta sign-in page on your domain.
• Microsoft 365 clone — reproduces Microsoft's real error codes (AADSTS50126, E0000004…) so credential sprays look exactly like the genuine flow.
• Fortinet VPN clone — a /remote/logincheck portal, the exact endpoint attackers spray.
• SSH honeypot — a realistic OpenSSH drop with tarpit, session recording and the credential-replay engine.

Deployment flow

1. Create the bait: pick a type, give it a name, set the domain it will answer on (e.g. login.yourcompany-sso.com — you bring the domain).
2. Delegate DNS: the console shows you 4 NS records. Create them at your registrar for the bait's subdomain.
3. We do the rest: dedicated IP, DNS records, the honeypot container, and a Let's Encrypt certificate — automatic.
4. Status goes Active: every touch is scored, recorded and surfaced in your dashboard in real time.

Status lifecycle in the console: Queued → Provisioning → Waiting for DNS → Active. A bait stays in Waiting for DNS until delegation resolves — that's DNS propagation, not a failure.

Branding (make it yours)

Web baits (Okta, Microsoft, Fortinet) accept your own assets so the page matches your organization:

• Logo — shown on the sign-in form
• Favicon — browser tab icon
• Background — full-page backdrop

Open a bait from the Baits page and click Branding. Uploads apply live — no redeploy needed. Maximum 500 KB per asset.

Self-hosted agents (your infrastructure)

Run the deception layer inside your own estate for internal threat detection:

1. Open Agents in the console and create an agent — you get a scoped API key (shown once; store it well).
2. Download the agent zip for your platform.
3. docker compose up -d — the agent registers, pulls its decoy profile and starts reporting.

Agent keys are scoped: ingest keys can only push events (write-only), deploy keys can only fetch decoys. Keys are stored hashed and can be rotated from the console without downtime.

Decoy profiles & honeycreds

Decoy profiles define what a bait looks like from the inside: hostname, OS flavor, planted files (runbooks, wikis, .env files) and honeycreds — canary credentials.

• Any use of a honeycred is an instant critical alert — and tells you exactly which file leaked.
• The credential-replay engine remembers every password cracked on your grid: replayed anywhere else, it's recognized immediately.
• Lock-on-crack: once an account is cracked on a bait, it stops accepting other passwords — an attacker probing with a wordlist reveals themselves.

Alerts

Critical events (honeytoken triggers, credential compromises) generate an email alert with the full evidence pack: source IP, captured credentials, session recording, TTP score. Alerts go to your tenant's admin emails via AWS SES.

Every event is also live in the console: dashboard, attacker profiles, global CTI, per-session forensic replay.