I got my handle at DefCon 25 August 2017, first time there, didn't have an official name beyond a gaming tag, and a name generator spat out "AfterPacket." It stuck. Everything since has been under that banner.
I build open-source tools for defenders who'd rather understand attackers than just block them. That means honeypots that lie convincingly, proof-of-work systems that don't need CAPTCHAs, red-team platforms that break LLMs on purpose, and internet-scale monitoring that watches when the wires go dark.
I don't trust third-party services with my data so I self-host everything, document it, and ship it open source. If you can't read the code, you can't trust the defense.
My honeypot framework is named after carnivorous plants. Each one traps attackers differently that's not a metaphor, it's the design spec.
Multi-protocol deception. Impersonates real services, tarpits the attacker, records every byte, and turns those bytes into threat intelligence. Sundews trap by adhesion — you stick to it, and the longer you struggle the more it learns about you.
ICS/SCADA honeypot. Presents a Schneider Modicon PLC over Modbus/TCP and EtherNet/IP. Behind it: a simulated pump station, a tiered loot chain that rewards deep exploration, per-address scoring, tarpitting, and an SSH-tunneled dashboard so you can watch the attackers in real time. Bladderworts trap by suction — one wrong probe and you're inside with no way back out.
Every capture from the Drosera honeypot gets a full writeup: YARA rule, Suricata rules, IOC feed, firewall block entries, and a report explaining why each indicator is in and why each candidate was left out. I don't ship signatures that would false-positive across a real estate. Shared CDN ranges never make the feed.
Master blocklist — newline-delimited IPs and domains, safe to curl on
a cron:https://github.com/ghraw/AfterPacket/drosera-threat-intel/main/blocklist.txt
Full OWASP GenAI Top 10 red-teaming. Multi-provider, automated jailbreak testing, mutation engines, PromptFoo imports, synthetic attack generation. If your model has a weakness, Vexor will find it before someone else does.
Adaptive SHA-256 puzzles for PHP and WordPress. No CAPTCHA, no JS fingerprinting, no third-party services. Bots solve math; humans never see anything. That's the whole pitch.
Aggregates IODA, GDELT, Cloudflare Radar, and RIPE Atlas to watch the internet go dark in real time. Built for correlating outages against real-world events — because when a country drops off the map, the "why" matters more than the "what."
Username enumeration, face correlation, breach intel, metadata extraction, multi-provider searching. Open source, self-hosted, no API keys required to start.
No database. Argon2id sessions, CSP headers, 2FA, alerting. I wrote it because every other flat-file CMS treated security as an afterthought.
| Repo | What it does |
|---|---|
| War Room | Geopolitical intelligence dashboard |
| CDN Origin Audit | Finds exposed origins behind CDNs |
| Network Tools | Packet analysis and debugging |
| AI Security Labs | Prompt injection / jailbreak research notes |
| Cryptography Experiments | Applied crypto — PoW, signed cookies, adaptive difficulty |
| Web Security Utilities | Misc defensive tooling |
Languages:
Infrastructure:
Security tooling:
- Drosera v1.0 — getting the core platform to a stable release
- Utricularia protocol expansion — adding DNP3 and S7comm so the PLC deception covers more vendor ecosystems
- Attacker replay system — record a session from one honeypot, replay it against another to see if detection catches it
- Public REST API for honeypot telemetry so other tools can pull feeds programmatically
- AI-powered IOC enrichment — correlating captures against threat feeds without manual triage
- Internet censorship timeline — a historical record, not just a live view
I'd rather watch an attacker for an hour than block them in a second. Blocking teaches you nothing. Every probe, every credential attempt, every lateral move is a data point — and enough data points become a profile, and enough profiles become a pattern, and patterns are what actually let you get ahead of the next attack instead of reacting to the last one.
I build everything privacy-first and self-hostable because defenders shouldn't have to hand their telemetry to a third party to get value from it. If I wouldn't run it on my own infrastructure, I don't ship it.
Open source isn't charity — it's force multiplication. Every person who runs Drosera makes the blocklist smarter. Every person who runs Vexor makes the next LLM harder to jailbreak. That's the whole point.
Build. Defend. Share.
Every attacker interaction is an opportunity to learn.