A self-hosted honeypot link tracker. Create a secret-looking URL, share it with a target, and get notified the instant it's opened — with geolocation, device info, a private control panel, and optional webhook alerts.

Built for scam baiting, OSINT, and catching unauthorized access to sensitive material.

Built entirely with Claude (Anthropic). Every line of code, config, and documentation in this project was written through an iterative AI-assisted development session — no manual coding.

Watch the setup & feature walkthrough on YouTube

• Deceptive templates — the public page looks like a generic secret share, a banking portal, a crypto wallet, an invoice, a corporate document, or a docs site
• Burn-on-reveal toggle — optionally destroy the secret after the first read, or leave it persistent for continued monitoring
• Full access logging — every visit captures IP, city/state/country, ISP, browser, OS, referrer, and timestamp
• Private control panel — stat cards, activity chart, world map, US state heat map, device breakdown, IP lookup, raw log table with CSV export
• Webhook alerts — configure a Discord webhook or any HTTP endpoint from the control panel; test pings included
• Location tracking — optionally require GPS confirmation before revealing the secret; mobile visitors are prompted to share location
• Zero external requests at runtime — fonts, Chart.js, and map SVGs are all self-hosted; no CDN calls, no third-party analytics
• Strict CSP — script-src 'self', style-src 'self', default-src 'none'; zero inline styles or scripts
• Docker-first — single docker compose up -d to deploy; SQLite persisted in a named volume

git clone https://github.com/rehatiel/nullvault.git
cd nullvault
cp .env.example .env

Open .env and set at minimum:

BASE_URL=https://your-domain.com
CREATION_SECRET=your-long-random-secret

Generate a strong secret:

openssl rand -hex 32

docker compose up -d

The app listens on port 3000. Put Nginx, Caddy, or a Cloudflare Tunnel in front.

Visit https://your-domain.com to create your first honeypot link from the web UI.

Visit the home page to create a link using the form. Options:

After creation you'll receive a public URL to share and a control URL to bookmark — the control URL is your private dashboard.

Every link has a private dashboard at /s/<public_token>/control:

• World map — countries with accesses are highlighted; hover for name + count
• US state heat map — appears automatically when US traffic is detected; states coloured on a 4-level scale (amber → red) relative to the most-active state

Configure from the Settings tab. Format is auto-detected:

• Discord — rich embed with event type, IP, location, user agent, referrer
• Generic HTTP — JSON POST with event, publicUrl, ip, location, userAgent, referer, timestamp

A Send Test Ping button fires a real request with test: true to verify delivery.

All endpoints return JSON. Link creation requires an X-Creation-Secret header matching CREATION_SECRET.

Headers:

X-Creation-Secret: <CREATION_SECRET>
Content-Type: application/json

Body:

Response 201:

{
  "publicUrl":  "https://your-domain.com/s/<token>",
  "controlUrl": "https://your-domain.com/s/<token>/control",
  "expiresAt":  1234567890
}

server {
    listen 443 ssl;
    server_name your-domain.com;

    location / {
        proxy_pass         http://localhost:3000;
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }
}

your-domain.com {
    reverse_proxy localhost:3000
}

Set TRUST_PROXY=1. NullVault reads the real IP from CF-Connecting-IP automatically.

git pull
docker compose up -d --build

The database schema migrates automatically on startup — no manual steps needed.

• The controlUrl is the only access control for the dashboard — treat it like a password
• CREATION_SECRET protects link creation; use a long random value
• Geolocation uses the bundled geoip-lite offline database — no outbound IP lookups
• Helmet.js enforces strict CSP: no inline scripts, no inline styles, no external resources
• SQLite WAL mode is enabled for safe concurrent reads during traffic spikes

This project intentionally limits data collection. Logged metadata includes:

• IP address, timestamp, and requested path
• User-Agent string and HTTP referrer
• Standard HTTP headers (Accept-Language, Sec-CH-UA, Sec-Fetch-Site)
• Approximate geolocation (city / region / country via offline database)
• GPS coordinates (only if the visitor explicitly grants browser location permission)

The application does not execute client-side exploits, use invasive fingerprinting, track users across sessions, or attempt to deanonymize visitors.

This software is provided for educational and research purposes only.

By using this project, you agree that:

• You are responsible for complying with all applicable local, state, and international laws
• You will not use this software for harassment, doxxing, retaliation, or unauthorized surveillance
• You understand that IP-based geolocation is approximate and unreliable
• You will not attempt to identify, track, or harm individuals using this software
• The authors and contributors assume no liability for misuse

This is not a hacking tool, a doxxing platform, a credential harvester, or a law enforcement solution.

MIT