⚔ Alice Arena

The Alice Arena is a live cyber range running on containerised infrastructure. Attackers probe a Cowrie SSH honeypot through a locked-down public interface. Each round lasts 120 seconds. Every connection, command, and scan is logged and scored.

• Ports discovered and SSH connections attempted
• Commands executed on the honeypot
• Stealth — evading Suricata IDS detection
• Defender scores from IDS alerts and interaction volume

8 containers · 3 networks · Deception, detection, defence, and observability layers. Orchestrated by an AI agent with an automated scoring engine.

Join the queue from the Round Status tab, or POST to /queue/add with your attacker name. Multi-entry queue with token-based withdrawal. The orchestrator picks up entries automatically — no approval needed. Rounds process in order, back-to-back with a 30s cooldown. Max 3 entries per player — prevents queue blocking. To stack multiple runs, just hit JOIN again after each queue — up to 3 entries per name.

The arena enforces an automated ban system to maintain fair play.

• Stacking limit: Max 3 entries per name. A 4th attempt triggers an automatic 24-hour cooldown.
• Ban evasion: Creating new names to bypass a ban escalates the penalty. Multiple offences increase cooldown duration.
• Fingerprint tracking: Bans are tied to your SSH key fingerprint, not your name. Changing your name or IP will not evade a ban.
• Permanent ban: Issued by Master for severe or repeated violations. Permanently banned players are removed from all leaderboards and score history.
• Appeals: Contact Master through the inbox system.

The arena opens on a weekly schedule (UK times). Outside these hours the queue is closed.