Stream Helios honeypot tunnel destinations in real time

Real-time NDJSON stream of the destinations Helios honeypot tunnels were asked to reach: the host name (or address literal) and port, plus the proxy/server/pool metadata of the inbound tunnel. Despite the feed name, domain is the tunnel destination, not a DNS query name — the names resolved inside a tunneled DNS session are not visible.

Required scope: HONEYPOT_DNS_STREAM. Schema: see HoneypotDNSStreamEntry under Components.

Sample event:

{"timestamp":1714780800123,"tunnel_id":42,"domain":"api.ipify.org","port":443,"protocol":"dns","meta":{"proxy_ip":"203.0.113.10","server":"hp-eu-1","pool_id":"prod","provider":"luminati"}}