Lilytrap Start free

Block attackers at your edge.

Every incident gives you attacker IPs. Lilytrap turns them into a block list. Your firewall does the blocking.

Pip the frog guarding his honey pot on a sunny windowsill.

  1. An agent takes the bait

    It uses a decoy credential. Lilytrap opens an incident.

  2. Lilytrap lists its IPs

    A swarm across many IPs is still one incident.

  3. Your edge blocks them

    Resolve the incident to unblock.

Start with these settings

Put them in lilytrap.json. You can also set them in the dashboard under Settings.

lilytrap.json

{
  "respond": {
    "blocklist": {
      "minSeverity": "high",
      "ttlHours": 24,
      "allow": ["203.0.113.0/24"]
    }
  }
}
minSeverity: high
Only block when a decoy credential was actually used.
ttlHours: 24
Agents rotate IPs. Old IPs often belong to someone else later.
allow
Add your office and VPN egress. These are never blocked.

Secret scanners like GitHub and GitGuardian are never blocked. Neither are your internal identities.

Connect your firewall

Pick what guards production. AWS WAF gets blocks pushed to it. Everything else pulls a feed.

AWS WAFPushed by Lilytrap
  1. Add the module in the account and region of your web ACL.

main.tf

module "lilytrap_waf" {
  source       = "github.com/lilytrap/lilytrap//terraform/aws/modules/waf-block?ref=v0"
  workspace_id = "ws_…"  # dashboard → Settings
}
  1. Add a block rule for the two IP sets to your web ACL. The module's rule_example output has one.
  2. Put the module's lilytrap_config output under respond in lilytrap.json.

The module creates two IP sets and one role. The role can only update those IP sets. It only works with your workspace id.

Lilytrap updates the IP sets when an attacker appears. It checks again every five minutes.

For CloudFront, use scope = "CLOUDFRONT" in us-east-1. Without Terraform, use the CloudFormation template.

Palo Alto NetworksFeed
  1. Go to Objects → External Dynamic Lists. Add one of type IP List.
  2. Set the source to the feed URL.
  3. Under client authentication, enter any username. Use the feed key as the password.
  4. Set the refresh to every five minutes.
  5. Use the list as the source in a deny rule. Put it above your allow rules.
Fortinet FortiGateFeed
  1. Go to Security Fabric → External Connectors. Create a threat feed of type IP Address.
  2. Set the URI to the feed URL.
  3. Turn on HTTP basic authentication. Use the feed key as the password.
  4. Set a short refresh rate.
  5. Use the feed as the source address of a deny policy.
CloudflareScheduled sync
  1. Create an account-level IP list called lilytrap_block.
  2. Add a WAF custom rule: ip.src in $lilytrap_block, action Block.
  3. Run this every five minutes. It replaces the list with the feed.

sync.sh

curl -fsS -u "feed:$LILYTRAP_FEED_KEY" https://api.lilytrap.com/feeds/v1/blocklist \
  | jq -Rn '[inputs | select(length > 0) | {ip: .}]' \
  | curl -fsS -X PUT "https://api.cloudflare.com/client/v4/accounts/$CF_ACCOUNT_ID/rules/lists/$CF_LIST_ID/items" \
      -H "authorization: Bearer $CF_API_TOKEN" -H 'content-type: application/json' --data-binary @-
Any other firewallFeed

Most firewalls and WAFs can import an IP list over HTTPS. Point them at the feed URL. Use basic auth with the feed key as the password.

The feed

Create a feed key in the dashboard under Settings → Block list. It can only read the block list.

feed URL

https://api.lilytrap.com/feeds/v1/blocklist

It returns one IP per line. An empty list means nothing is blocked right now. Add ?format=json to see when each IP expires.

Send events to your SIEM

Every event arrives as one row. Your security team can search it with everything else.

SplunkHTTP Event Collector
  1. Create an HTTP Event Collector token in Splunk.
  2. Add it under alerts in lilytrap.json.
  3. Press Send test event in the dashboard under Settings → SIEM.

lilytrap.json

"splunk": {
  "url": "https://http-inputs-<stack>.splunkcloud.com/services/collector/event",
  "token": "${LILYTRAP_SPLUNK_TOKEN}",
  "index": "security"
}

Events arrive with sourcetype=lilytrap. The endpoint needs a publicly trusted certificate. Splunk Cloud has one.

Microsoft SentinelLogs Ingestion API
  1. Add the module next to your Sentinel workspace.

main.tf

module "lilytrap_sentinel" {
  source                     = "github.com/lilytrap/lilytrap//terraform/azure/modules/sentinel?ref=v0"
  log_analytics_workspace_id = azurerm_log_analytics_workspace.sentinel.id
  resource_group_name        = azurerm_resource_group.security.name
  location                   = azurerm_resource_group.security.location
}
  1. Put its lilytrap_config output under alerts in lilytrap.json.
  2. Press Send test event in the dashboard under Settings → SIEM.

The module creates a Lilytrap_CL table. It also creates an app that can only write to that table.

Keep the client secret in an environment variable. Reference it as ${LILYTRAP_SENTINEL_SECRET}.

Using something else? The webhook sends every event as signed JSON.

Good to know

Why IPs and not MAC addresses?
MAC addresses never leave the local network. Over the internet, the IP is what your edge can see.
What about the leaked credential?
The incident names the build and file it came from. Rotate it there. The incident brief walks your coding agent through it.
Can a block hit a real customer?
Rarely. Only addresses that used a decoy get listed. Short TTLs keep it rare.
Do I need to block at all?
No. Alerts work without it. Blocking is off until you connect a firewall.

Setting this up with an agent? Section 4b of setup.md has the same steps for agents.