Open software—
Material reviewed: Repository documentationDocker-based MHN subset that includes Cowrie and Dionaea honeypots connected to an hpfeeds broker to publish events.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationmicro-honeypot is described on its repository page as a simple honeypot designed to block port scanning.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA service that provides immutable persistence for hpfeeds, normalizes data from multiple honeypot sensors (dionaea, kippo, glastopf, thug, beeswarm), and exposes the normalized data through a RESTful API.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationCentralized server that manages deployment of honeypot sensors (Snort, Cowrie, Dionaea, glastopf, among others) and collects their data through a web interface; MHN itself is orchestration and collection infrastructure, not a honeypot, though it supports honeypot techniques via the sensors it deploys.
Network
Open software—
Material reviewed: Repository documentationConfigurable honeypot that responds to expected scanner commands, such as Mirai's, to fingerprint their IP addresses; supports file and syslog output.
NetworkIoTHoneypot
Open software—
Material reviewed: Repository documentationA simple telnet honeypot created to show, in a security talk, how easy it is to code a telnet honeypot in order to recover IoT malware and observe active command and control.
IoTNetworkHoneypot
Open software—
Material reviewed: Repository documentationOpenFlow application for POX that detects unused IP addresses through ARP snooping and redirects traffic destined for them to a specified honeypot. It is deception-routing infrastructure, not the destination honeypot.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA platform to run private unannounced honeypots as Tor hidden services (Onion Decoys), using Docker containers combining Glastopf (HTTP) and Cowrie (SSH and Telnet), with randomly generated, unpublished onion addresses.
NetworkHoneypot
Open software—
Material reviewed: Repository metadataCritical readingMulti-protocol network honeypot for detecting suspicious interactions inside networks.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA web backend (Tornado+Vue+Mysql+APScheduler+Nginx+Supervisor) providing a dashboard, host status, attack list, filter lists, and mail configuration to visualize and manage events detected by the OpenCanary honeypot.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationOpen-source Python software designed for creating honeypot and honeynet setups in an easy and secure way, compatible with Python 3.x and tested on Mac OS X and Linux, with example modules for FTP, HTTP, and SSH deployed via containers.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationA Go tool that sets up a decoy (honeypot) port and executes a configurable command against every IP that connects to it, described by the author as suited for informal settings like conferences.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationPre-alpha honeypot daemon documented to filter and redirect SSH traffic to a protocol handler and then to a sandbox if the connection is accepted.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA lightweight package described as a minimal-interaction honeypot, combining a Python port-listening script with a PHP web backend to log incoming connections.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationA script that uses Docker to quickly deploy several honeypots (Conpot, Cowrie, Heralding, Honeyaml, among others) exposing multiple services for research and reconnaissance.
NetworkOT/ICSHoneypot
Open software—
Material reviewed: Repository documentationA tool and library for intercepting RDP connections; the documentation describes credential logging and session replay. It can support observation of actors but is not presented as a honeypot.
Network
Open software—
Material reviewed: Repository documentationRDP honeypot that assigns a virtual machine to each session and documents disk and traffic capture for BlueKeep telemetry.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationFraud-detection tool that receives attempted calls and SIP probes, recording source IPs and dialed numbers for alerts and lookup. Its deception link is allowing and observing those attempts.
NetworkAdversary engagement
Open software—
Material reviewed: Repository documentationProject described as a honeypot network. The supplied instructions cover startup and configuration of Snort, an alert rule, and MySQL, but do not explain how the honeypots operate.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationTool described as an open-relay simulator for spam capture and analysis.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationLow-interaction SSH honeypot that logs incoming IP addresses, usernames, and passwords without allowing logins.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA C program that listens for incoming SSH connections and logs the IP address, username, and password used, written to gather rudimentary intelligence on brute force attacks.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA simple Python SSH server that logs all username/password combinations attempted against it to a logfile, intended to be deployed on a redirected port via iptables.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationModified OpenSSH daemon that forwards commands to Cowrie to interpret interactions and log brute-force attacks and SSH sessions.
NetworkHoneypotAdversary engagement