Homelab
interactive mapWhere the research happens: a Proxmox server, a private Tailscale mesh, a Tor relay, an always-on mini PC, a locked-down malware lab and a throwaway Active Directory forest. Open the map and click around.
OPERATION HOMELABT+00:00
ACCESS GRANTED
3D isn't available in this browser. Close this and read the lab summary on the page.
The hardware
Dell PowerEdge R620
32 cores · 250 GB DDR3 · 10 TB storage
The heavy iron: every range and the malware zoo run here.
Mini PC
4 cores / 8 threads · 8 GB RAM
Tiny, quiet, never off. Keeps the essentials alive.
Lenovo laptop (battle-damaged)
Beaten up, still fighting
Dedicated hardware for Tor and anti-forensics work, kept off the main network.
The maps
Network
WAN, firewall, VLANs, WireGuard and the three machines everything runs on. Start here, then drop through a portal into a range.
Cyber Range
A disposable Active Directory network with a Kali attacker, a C2 server and an exposed web app, for practising the full attack path and what each step leaves in the logs.
Malware Zoo
Twenty LXC containers on an isolated VLAN with no route to anything. Samples run against a fake internet while every packet is captured, then everything reverts to a clean snapshot.
SOC / DFIR + AI
Endpoints report to Velociraptor, detections are written as Sigma rules in Git, a SIEM correlates everything, and a swarm of LangChain agents helps triage the alerts.
Mobile & macOS
Android emulators and real devices, an iOS bench, and a docker-OSX macOS box, all behind an intercepting proxy, for reverse engineering apps and testing how devices leak.