Skip to content

Back to the catalog

SiberKapan
github.comrepo

SiberKapan

SiberKapan is a Turkey-focused, community-driven open-source threat intelligence platform that aggregates data from FortiGate webhooks, an 11-service honeypot (HoneypotKapan), nginx/Fail2ban log watchers, and external feeds, publishing it as STIX 2.1/TAXII 2.1, a MISP default feed, Sigma/Suricata/Wazuh exports, and REST blocklists. It also runs a real-time phishing/domain-squatting detector via Certificate Transparency log monitoring with fuzzy typosquat and Punycode/IDN decoding, and safely fingerprints SSH-honeypot malware downloads with SSRF-protected, never-executed hashing enriched via MalwareBazaar. The write-up details concrete anti-abuse safeguards: time-based IP score decay, CDN/cloud-proxy allowlisting, UDP-spoofing exclusion, RFC1918 rejection, and manual review gating for weak phishing signals.

TL;DR Open-source Turkish threat-intel platform combining honeypots, Certificate Transparency phishing detection, and STIX/TAXII/MISP/Sigma feed exports with documented anti-poisoning safeguards.
Open original ↗
Document

What it is

SiberKapan is a community CTI platform for threats against Turkish infrastructure. The summary covers its scope and outputs; what it does not carry is the concrete integration mechanics an engineer needs to actually consume the feed — the API endpoints, the score-filtering parameter, and the FortiGate webhook contract.

How it works

Beyond the aggregation/detection pipeline already summarized, the platform exposes a REST API where blocklist exports are gated by a min_score query parameter, letting you trade coverage for confidence per format. It also supports incremental fetches via a ?since= timestamp and HTTP ETag/If-None-Match (returning 304 when unchanged) to avoid re-pulling the full feed.

What to do

Pull format-specific exports (note the differing default score thresholds the page uses — 75 for Suricata/Wazuh, 40 for Sigma):

curl -o /etc/suricata/rules/siberkapan.rules \
  "https://siberkapan.org/api/v1/export/suricata?min_score=75"
curl -o /var/ossec/etc/lists/siberkapan-blocklist \
  "https://siberkapan.org/api/v1/export/wazuh-cdb?min_score=75"
curl -o siberkapan.yml "https://siberkapan.org/api/v1/export/sigma?min_score=40"

Incremental / bandwidth-conscious fetch:

curl "https://siberkapan.org/api/v1/view/all-feed?since=2026-07-01T00:00:00Z"
curl -H "If-None-Match: \"sk-abc123\"" https://siberkapan.org/api/v1/view/all-feed

FortiGate: create an Automation Action (Webhook, HTTPS POST) to https://siberkapan.org/feed/fortigate, with headers X-SiberKapan-Key: <your-api-key> and Content-Type: application/json, then bind it to an Automation Stitch triggered on IPS Event or Anomaly Logs. Body uses FortiGate %%log.*%% variables (srcip, attack, dstport, severity, proto, srccountry, devname). An API key must be requested via siberkapan.org/iletisim.

For MISP, the feed is already in the default feed list, so it can be enabled without manual URL configuration. Enterprise SIEM/SOAR can consume via the TAXII 2.1 server (page names Anomali, ThreatConnect).

Caveats

  • FortiGate submission and API access both require an API key obtained by contacting the operator — this is not an anonymous public endpoint.
  • The malware-capture honeypot fingerprints samples (SHA256, SSRF-protected) but never writes or executes them, so it yields hashes for enrichment, not live samples.
  • Regional focus: the value proposition is threats targeting Turkish infrastructure and USOM-sourced domains; weigh relevance to your own exposure before ingesting the blocklist into enforcement.

Technologies named here

Techniques named here

  • Brand & intent keyword matching
  • Fuzzy typosquat detection
  • Punycode/IDN decoding
  • Domain liveness tiering
  • IP/domain score decay and aging
  • UDP spoofing exclusion
  • SSRF protection in malware sample capture
  • Infrastructure allowlisting
  • Multi-source corroboration scoring
  • Bounded/streamed malware sample fetch

Related in Threat Intel