THE SIGNAL
BEHIND NOISE.
Real decoy event capture, DNS-based exposure assessment, and explainable phishing-risk indicators. Separate real telemetry from future capabilities; no fake threat counts, dark-web claims or unauthorised network scanning.
AI Honeypots → live HTTP decoy
REAL SENSORThe isolated trap.shardsinc.co.uk sensor captures suspicious path probes as minimal, pseudonym-free event categories in EU D1. Responses never invoke Shards' production services. Decoy lures rotate by day; this is deterministic policy, not autonomous AI.
No raw IP addresses, headers, URL query strings, cookies or request bodies are written to the decoy database. Only sampled request categories and coarse datacentre/geographic information.
PhishRisk
EXPLAINABLE ANALYSISAnalyse a link without visiting the target site. The service inspects URL structure and makes a DNS-only query for the hostname. The score is heuristic, not a threat-feed or malware verdict.
Hostnames queried through Cloudflare DNS-over-HTTPS; the remote site is never opened or executed.
LeakScan → passive surface audit
LIVE DNS POSTUREInspect public DNS signals such as email authentication, mail records, DNS addresses and certificate issuance restrictions. This is not an active vulnerability scan or a discovery of all exposed services.
Do not interpret an absent SPF/DMARC/CAA record as proof of a successful attack or data leak.
Signal stream / SIEM
REAL EVENTS · GATED EXPORTActual event records are categorised by family, severity and time. The server has JSON/NDJSON and CEF export routes for security teams. Private export requires a configured secret; no Splunk, Sentinel or QRadar transport is connected yet.
CEF can be forwarded via a separate authorised Syslog pipeline. A compatible event format does not equal a native integration.
The HIBP password-hash exposure check works. Actual dark-web credential monitoring requires a licensed intelligence feed and domain/identity ownership verification.
LICENCED DARK-WEB FEED NOT CONNECTEDTenant and deployment records exist in the EU database. Only the Shards-owned sensor is active. Customer agents, tenancy isolation, MFA, role-based control and white-labelled MSSP reports require separate deployment and acceptance.
CLIENT ONBOARDING NOT ENABLEDCheck your browser's real Bluetooth API capability below. Site access cannot reliably monitor surrounding BLE traffic in the background or neutralise wireless attacks. A consent-based native Android agent is required.
Not inspected.
OFFLINE SECURITY AGENT NOT DEPLOYEDObserve. Correlate. Isolate. Never hack back.
Threat containment in this release means decoy/workload isolation and safe rejection of probes that reach the decoy. It does not block attackers elsewhere in your network, control radios, perform counterattacks or guarantee zero false-positive alerts. Production enforcement requires an approved Cloudflare WAF/Zero Trust policy and an authenticated operator.