BlackIce — Sandbox

⬡ EARLY PARTNER ACCESS

BlackIce Sandbox

Run the engine. See what it finds.

RUNS LEFT TODAY

SELECTED

🏦

Fintech Login Log

2,847 authentication events from a payment platform. Contains impossible travel, token reuse, and credential stuffing patterns.

2,847 events JSONL Fintech

SELECTED

🛒

E-commerce ATO Dataset

1,204 events from a retail platform. Features stealth attackers, behavioral anomalies, and account enumeration patterns.

1,204 events CSV E-commerce

SELECTED

🏛️

Banking Session Log

891 events from a retail bank. High-value transaction fraud with multi-device token reuse and velocity anomalies.

891 events JSONL Banking

blackice — engine v0.1 — sandbox mode

Select a dataset above and run the engine. BlackIce will replay all authentication sequences and surface every anomaly with full explanation.

Detect Account Takeovers in Seconds

Upload your login logs — BlackIce analyzes suspicious behavior and flags potential account takeovers.

WHAT WE ANALYZE
IP address changes
Geographic anomalies
Device switching
Time-based patterns
TOR/proxy usage
Velocity anomalies

30 ACTIVE DETECTION RULES

            impossible_travel
            credential_stuffing
            session_hijack
            tor_exit
            token_reuse
            ip_reuse
            device_reuse
            velocity_spike
            login_payment
            low_and_slow
            geo_ip_mismatch
            suspicious_hour
            new_device
            api_enumeration
            phishing_malware_chain
    idor_bola
    sequential_enumeration
          

          UPLOAD LOGIN LOGS (CSV OR JSON) · FIELDS: user_id, timestamp, ip_address, action, device_id, geo
        

📂

Upload Your Login Log

Drag & drop your CSV or JSONL file here, or click to browse.
Max file size: 5MB · Max 10,000 events in sandbox mode.

📄

File ready. BlackIce will parse your events, reconstruct attacker sequences, and surface anomalies with full reason codes.

Sends your data as-is · shows raw anomalies

NEW

JSONL Format

{"user_id":"u_1a2b","timestamp":"2026-01-15T09:14:22Z","ip":"185.12.44.3","device_id":"dev_abc","geo":"DE","action":"login"}
{"user_id":"u_1a2b","timestamp":"2026-01-15T09:31:07Z","ip":"103.25.8.91","device_id":"dev_abc","geo":"SG","action":"login"}

CSV Format

user_id,timestamp,ip,device_id,geo,action
u_1a2b,2026-01-15T09:14:22Z,185.12.44.3,dev_abc,DE,login
u_1a2b,2026-01-15T09:31:07Z,103.25.8.91,dev_abc,SG,login

Recent Uploads

Compare the last 10 runs saved locally in your browser.

🕒

User ID	Timestamp	Rule Fired	Risk Score	Verdict	Evidence