About
The Alice Arena is a live cyber range running on containerised infrastructure.
Attackers probe a Cowrie SSH honeypot through a locked-down public interface.
Each round lasts 120 seconds. Every connection, command, and scan is logged and scored.
Connect
ssh -p 2222 root@the-arena.com
Queue token is your password.
Join the queue from the Round Status tab → you receive a unique token.
Use that token as your SSH password. Only the token works — no other password will authenticate.
🔑 How token auth works
- Join the queue via the Round Status page — you get a unique token
- Your token is your password — save it. Nothing else will work
- When your round starts, the Round Status page shows ⏳ Waiting for player...
- SSH with
root + your token — the page shows ✅ Logged in
- After 120 seconds, the round ends and the token expires
⚠ Port 2222 only. 120 seconds per round. No other password will work.
Scoring
- Ports discovered and SSH connections attempted
- Commands executed on the honeypot
- Stealth — evading Suricata IDS detection
- Defender scores from IDS alerts and interaction volume
Infrastructure
8 containers · 3 networks · Deception, detection, defence, and observability layers.
Orchestrated by an AI agent with an automated scoring engine.
Queue & Automation
Join the queue from the Round Status page, or POST to /queue/add with your attacker name.
Multi-entry queue with token-based withdrawal. The orchestrator picks up entries automatically —
no approval needed. Rounds process in order, back-to-back with a 30s warm-up between each.
Max 3 entries per player — prevents queue blocking.
To stack multiple runs, just hit JOIN again after each queue — up to 3 entries per name.
Naming Rules
Attacker names are validated at the queue entry point — both client-side and server-side. Rules:
- Allowed characters: Letters (a-z, A-Z), numbers (0-9), and underscores (_)
- No spaces, hyphens, or other special characters
- Maximum length: 48 characters
- Client-side: Invalid characters are stripped as you type, with a warning message
- Server-side: Names with invalid characters are rejected with an HTTP 400 error and a clear message
Ban System
The arena enforces an automated ban system to maintain fair play.
- Stacking limit: Max 3 entries per name. A 4th attempt triggers an automatic 24-hour cooldown.
- Ban evasion: Creating new names to bypass a ban escalates the penalty. Multiple offences increase cooldown duration.
- Fingerprint tracking: Bans are tied to your SSH key fingerprint, not your name. Changing your name or IP will not evade a ban.
- Permanent ban: Issued by Master for severe or repeated violations. Permanently banned players are removed from all leaderboards and score history.
- Appeals: Contact Master through the inbox system.
Play Schedule
The arena opens on a weekly schedule (UK times). Outside these hours the queue is closed.
Monday - Thursday
23:00 - 23:59
Friday - Saturday
23:00 - 01:59
Sunday
Closed
Times are UK local (BST/GMT automatically detected).