AgentCapture
A countermeasure honeypot platform for security monitoring, red-blue exercises, and Internet system access. It connects to business systems non-intrusively through reverse proxying and bypass mirroring, identifies AI agent attackers, and performs profiling and session replay.
Timeline (last 90 days)
AgentCapture is a countermeasure-oriented honeypot platform for security on-duty operations, red-blue confrontation, and internet system access, which brings real business traffic into the monitoring system through reverse proxying, bypass mirroring, and origin pull.
Deploying AgentCapture does not require changing a single line of business code.
In the video demonstration, the AgentCapture console showed a total of 114 events, 94 high-risk events, three attacker source IPs, one online node, and 16 credential keys.
AgentCapture's attacker profiling module can identify signals such as "missing human browser characteristics" and "AI Agent UA characteristics" and thereby determine whether a visitor is using AI software.
The video mentions a 90% identification rate for Claude Code 2.0.1.
AgentCapture's profile details can display credential submission statistics such as 17 SSH brute-force attempts and two FTP attempts, as well as an automation score for the behavior sequence (such as 75 points in the demonstration).
AgentCapture can redirect attackers to emulated services such as MathEcho and FTP and record the complete session, including login credentials, executed commands, uploaded and downloaded files, and the operation time sequence.
In the honeypot session replay, actions such as the attacker attempting to change the password, executing the id command, and continuing operations as root all occur inside the honeypot and never touch the real server.
AgentCapture offers multiple deception forms including honeypot deployment, FTP service access, embedded honeypot management, and port service stations, and users can add ports themselves to lure brute-force attempts and logins.
AgentCapture's node management supports viewing and remotely adding nodes, and internet assets can be brought into the reverse proxy system by adding them.
3 more timeline events
All Facts (13)
AgentCapture is a countermeasure-oriented honeypot platform for security on-duty operations, red-blue confrontation, and internet system access, which brings real business traffic into the monitoring system through reverse proxying, bypass mirroring, and origin pull.
50%UnverifiedDeploying AgentCapture does not require changing a single line of business code.
50%UnverifiedIn the video demonstration, the AgentCapture console showed a total of 114 events, 94 high-risk events, three attacker source IPs, one online node, and 16 credential keys.
50%UnverifiedAgentCapture's attacker profiling module can identify signals such as "missing human browser characteristics" and "AI Agent UA characteristics" and thereby determine whether a visitor is using AI software.
50%UnverifiedThe video mentions a 90% identification rate for Claude Code 2.0.1.
50%UnverifiedAgentCapture's profile details can display credential submission statistics such as 17 SSH brute-force attempts and two FTP attempts, as well as an automation score for the behavior sequence (such as 75 points in the demonstration).
50%UnverifiedAgentCapture can redirect attackers to emulated services such as MathEcho and FTP and record the complete session, including login credentials, executed commands, uploaded and downloaded files, and the operation time sequence.
50%UnverifiedIn the honeypot session replay, actions such as the attacker attempting to change the password, executing the id command, and continuing operations as root all occur inside the honeypot and never touch the real server.
50%UnverifiedAgentCapture offers multiple deception forms including honeypot deployment, FTP service access, embedded honeypot management, and port service stations, and users can add ports themselves to lure brute-force attempts and logins.
50%UnverifiedAgentCapture's node management supports viewing and remotely adding nodes, and internet assets can be brought into the reverse proxy system by adding them.
50%UnverifiedAgentCapture includes alarm configuration and prompt management modules; the prompts are used for AI and Agent detection to help determine whether a visitor is an automated Agent or a normal visitor.
50%UnverifiedConnecting a honeypot into a real business link increases architectural complexity, and the stability and isolation boundaries of the reverse proxy layer must be verified in advance, otherwise the deception layer may become a new risk surface.
50%UnverifiedAgentCapture is best suited to two scenarios: security on-duty teams supplementing deception defense capabilities at low cost, and observing the behavioral characteristics of attacker Agents in red-blue confrontation.
50%