Open software—
Material reviewed: Repository documentationWeb honeypot that responds to HEAD and GET requests with an HTTP Basic challenge and logs received credentials; it accepts no username or password.
ApplicationIdentityHoneypot
Open software—
Material reviewed: Repository documentationA tool that parses logs from multiple honeypots (Kippo/Cowrie SSH, phpMyAdmin, Wordpot, Redispot, VncLowPot, Pghoney) to extract malicious IPs, URLs, and file hashes and publish them as pulses in AlienVault OTX.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationA high-interaction HTTP/HTTPS honeypot that presents vulnerable web applications to observe attacker access. The documentation says it sends logs to BigQuery and saves packet captures.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationSDN honeypot with an HTTP interface that simulates a failed login without connecting to a real service; the documentation suggests checking PostgreSQL records.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationElasticPot is a honeypot that emulates an Elasticsearch service, compatible with DTAG's T-Pot environment and also available as a dockerized version.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationRuby on Rails gem plugin documenting honey traps and configurable responses to detect and respond to malicious behavior in an application.
ApplicationDecoyAdversary engagement
Open software—
Material reviewed: Repository documentationA toolset including an Ethereum RPC node scanner and stealer, along with an RPC node honeypot described as intended to collect attacker information.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository metadataCritical readingWeb honeypot using a language model to generate interactions.
ApplicationHoneypot
Open software—
Material reviewed: Repository metadataCritical readingWeb application honeypot recording interactions with simulated attack surfaces.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationPerl script that queries Glastopf's SQLite database for statistics. It supports analysis of a web-application honeypot but is not described as a honeypot itself.
Application
Open software—
Material reviewed: Repository documentationDecoy software documenting bounded simulated responses for Kubernetes and Docker APIs, Ollama and other AI APIs, a misconfigured kubelet, and HTTP probes; it records TCP and UDP interactions without replying. It supports synthetic Secret honeytokens.
CloudNetworkHoneypotHoneytoken
Open software—
Material reviewed: Repository documentationWeb honeypot documented to create and monitor fake HTTP endpoints whose URLs can be distributed as honeytokens; it is designed for Heroku but can also run on a self-hosted server.
ApplicationCloudHoneypotHoneytoken
Open software—
Material reviewed: Repository documentationServerless application that creates and monitors fake HTTP endpoints for use as URL honeytokens; its documentation describes deployment with AWS Lambda and API Gateway.
ApplicationCloudHoneytokenDecoy
Open software—
Material reviewed: Repository documentationLaravel package that adds a hidden field and encrypted timestamp to forms to identify likely bot submissions.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationA module for pH7CMS that presents a fake admin panel to lure and log attackers, leveraging the CMS's built-in analytics tracking.
ApplicationHoneypotDecoy
Open software—
Material reviewed: Repository documentationDocumented ExpressionEngine extension that adds a hidden honeypot field to comment and user forms to block automated spam submissions without using a CAPTCHA.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationA Drupal module that adds a hidden honeypot field and a time-based restriction to forms in order to detect and block automated spam submissions.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationExample of using honeypots with a Standalone model and a model with the Joomla CMS for PHP applications.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationHoneyPress is a WordPress honeypot shipped in a Docker container, documented with a Flask/Python reimplementation simulating a WordPress install, logging access via Nginx, and storing captured payloads (including IP, user-agent, and commands) in a MongoDB database.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationA simple web application honeypot that uses SimpleHTTPServer to serve a retro-styled HTML page, intended to attract and log basic web interactions.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationSystem integrating multiple client honeypots and a crawler to process URLs and detect malicious websites.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationA bash script for CentOS that combines Apache, Cloudflare, and a CMS (mainly WordPress) to detect malicious requests in server logs and temporarily block the attacker's real IP via the Cloudflare API.
ApplicationNetworkDecoy
Open software—
Material reviewed: Repository documentationhttpbl is a Python client package for the Project Honeypot Http:BL API, allowing queries of threat scores and visitor types for IP addresses.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationAn instant messenger honeypot; the documentation only describes it as 'Instant messenger honeypot', without detailing protocols or detection mechanisms.
ApplicationNetworkHoneypot