Open software—
Material reviewed: Repository documentationSSH honeypot written in Go; the documentation describes configuring its port and host key and observing login attempts.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationGo-based SSH honeypot that, according to its documentation, accepts credentials, presents a fake shell, and records attempted commands.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationDecoy software documenting bounded simulated responses for Kubernetes and Docker APIs, Ollama and other AI APIs, a misconfigured kubelet, and HTTP probes; it records TCP and UDP interactions without replying. It supports synthetic Secret honeytokens.
CloudNetworkHoneypotHoneytoken
Open software—
Material reviewed: Repository documentationDocker-deployed honeypot for detecting port scans; documents port configuration and logging of connection attempts.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationHoneyd is a small daemon that creates virtual hosts on a network, capable of running arbitrary services and adapting their TCP personality to simulate operating systems, enabling a single host to claim multiple addresses for network simulation.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationDaemon that creates virtual network hosts and can simulate services and TCP personalities to appear as different operating systems, per the project's documentation.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationSMTP honeypot with configurable responses, TLS and STARTTLS support, BoltDB email storage, and an API for retrieving messages.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationMaltego transform pack for graphing Kippo honeypot data stored in MySQL. Its deception link is analysis of that data; it is not described as a honeypot.
Network
Open software—
Material reviewed: Repository documentationHoneyMiner is a bash script that automates the installation of a crypto currency mining tool (minergate-cli) and a honeypot agent (honeydb-agent) on remote servers, per its documentation.
NetworkCloudHoneypot
Open software—
Material reviewed: Repository documentationMySQL honeypot project described in a README preserved in a mirror repository.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationHoneyPi is a bash script to install and run various honeypot projects on a Raspberry Pi running Raspbian, serving as an installation guide.
NetworkIoTHoneypot
Open software—
Material reviewed: Repository documentationPowerShell script that listens on specified TCP ports, logs incoming connections, and optionally blocks suspicious IP addresses via Windows Firewall, with whitelist support and detailed logging.
EndpointNetworkHoneypot
Open software—
Material reviewed: Repository documentationBash and Python scripts that listen on a decoy port and can block a connecting source IP. They do not simulate a full application or protocol.
NetworkDecoy
Open software—
Material reviewed: Repository documentationA low-interaction network honeypot written in Rust that emulates SSH, FTP, and Telnet protocols, captures credentials, and provides a real-time dashboard with attack visualization and geolocation.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA Ubuntu-based Docker image that sets up an SSH honeypot, logging usernames and passwords used by attackers during login attempts, based on code and instructions from an external tutorial.
NetworkIdentityHoneypot
Open software—
Material reviewed: Repository documentationNode.js honeypot that emulates the TCP-32764 router backdoor and provides logs for monitoring.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA collection of support scripts for honeypots, minimally described in its documentation.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA script for Ubuntu 12.04 that automatically installs and configures Kippo, Dionaea, and p0f as system services, changing the SSH port and turning the host into a honeypot.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationFlask site for displaying data collected by an SSH honeypot, including attempts and statistics. It is deception-adjacent visualization software, not itself described as a honeypot.
Network
Open software—
Material reviewed: Repository documentationLow-interaction honeypot with plugins that can emulate TCP or UDP services and log activity. The project states it is no longer actively developed.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationExtensible SSH honeypot written in Go using crypto/ssh to accept connections and log failed login attempts, including usernames and passwords. It supports dropping process privileges and includes a Lua-based plugin engine to process captured information, plus a virtual filesystem to more convincingly emulate a system.
NetworkEndpointHoneypot
Open software—
Material reviewed: Repository documentationSSH honeypot that logs username and password attempts during brute-force attacks, rejecting them with a wrong-password message. Includes statsd, a simple HTTP API for querying login attempts.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA bash script for CentOS that combines Apache, Cloudflare, and a CMS (mainly WordPress) to detect malicious requests in server logs and temporarily block the attacker's real IP via the Cloudflare API.
ApplicationNetworkDecoy
Open software—
Material reviewed: Repository documentationHoneypot that simulates a modem or router with a RomPager web server and TR-069 support; it documents vulnerability emulation and communication logging.
IoTNetworkHoneypot