Open software—
Material reviewed: Repository documentationSSH tarpit that slowly sends an endless banner to tie up connecting SSH clients while the real SSH server uses another port.
NetworkAdversary engagementDecoy
Open software—
Material reviewed: Repository documentationA Splunk app that analyzes JSON logs from the Cowrie SSH honeypot to provide dashboards and metrics on attacker engagement, aiming to observe behavioral changes when honeypot configuration settings are adjusted.
NetworkHoneypotAdversary engagement
Open software—
Material reviewed: Repository documentationA MicroPython honeypot for the ESP8266 microcontroller that emulates a Telnet server to attract and observe attack attempts against exposed Telnet devices.
IoTNetworkHoneypot
Open software—
Material reviewed: Repository documentationA toolset including an Ethereum RPC node scanner and stealer, along with an RPC node honeypot described as intended to collect attacker information.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationA collection of scripts to install and run DionaeaFR and to index Cowrie honeypot data into Elasticsearch, aiding visualization of data collected from Dionaea and Cowrie honeypots.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA Python honeypot that listens on all TCP and UDP ports, emulating services such as SSH, telnet, SMTP, HTTP/HTTPS, SIP (with sipvicious scan detection), and a Netis router factory backdoor, logging unrecognized traffic in hexdump-like form.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationFakeSSH is a dockerized SSH honeypot server written in Go that logs login attempts. Per its documentation, password authentication always fails, so no terminal access is granted to the attacker.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationProtocol server simulator documenting fake network services, interactions, and traffic logging, including industrial protocols.
NetworkOT/ICSDecoy
Product—
Material reviewed: Public pageCritical readingCommercial decoy and breadcrumb platform for network, identity and cloud, according to Fidelis.
NetworkIdentityDecoyHoneytoken
Product—
Material reviewed: Public pageCritical readingFortinet platform for deploying decoy assets and alerting on their use.
NetworkOT/ICSDecoyHoneypot
Open software—
Material reviewed: Repository documentationGo honeypot server documented to listen on configured ports and log details of received data to a database.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationSSH honeypot written in Go; the documentation describes configuring its port and host key and observing login attempts.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationGo-based SSH honeypot that, according to its documentation, accepts credentials, presents a fake shell, and records attempted commands.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationDecoy software documenting bounded simulated responses for Kubernetes and Docker APIs, Ollama and other AI APIs, a misconfigured kubelet, and HTTP probes; it records TCP and UDP interactions without replying. It supports synthetic Secret honeytokens.
CloudNetworkHoneypotHoneytoken
Product—
Material reviewed: Repository documentationHFish is a free, community-oriented honeypot product developed by Beijing Microstep Online Technology Co., Ltd., aimed at enterprise scenarios such as internal lateral-movement detection, external threat perception, and intelligence generation. Its documentation states it supports over 90 honeypot service types, a B/S architecture with a server (管理端) and node/client (节点端) component, and multiple alert channels (email, syslog, webhook, WeChat Work, DingTalk, Feishu).
NetworkApplicationHoneypotDecoy
Community or education—
Material reviewed: Repository documentationA curated GitHub list aggregating open-source honeypot resources (database, web, WordPress, service, ICS/SCADA honeypots), network and data analysis tools, and deployment guides, organized by category.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationDocker-deployed honeypot for detecting port scans; documents port configuration and logging of connection attempts.
NetworkHoneypot
Framework or guide—
Material reviewed: Repository documentationHoneycomb is an open-source honeypot framework created by Cymmetria that allows running honeypots with various integrations via a public plugin library, and makes it easy to write new honeypot services.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationHoneyd is a small daemon that creates virtual hosts on a network, capable of running arbitrary services and adapting their TCP personality to simulate operating systems, enabling a single host to claim multiple addresses for network simulation.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationDaemon that creates virtual network hosts and can simulate services and TCP personalities to appear as different operating systems, per the project's documentation.
NetworkHoneypotDecoy
Dataset or lab—
Material reviewed: Repository documentationA dataset and analysis of 2016 logs generated by the Cowrie, Dionaea, and Glastopf honeypots, with statistics on captured passwords and access attempts.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationSMTP honeypot with configurable responses, TLS and STARTTLS support, BoltDB email storage, and an API for retrieving messages.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationMaltego transform pack for graphing Kippo honeypot data stored in MySQL. Its deception link is analysis of that data; it is not described as a honeypot.
Network
Open software—
Material reviewed: Repository documentationHoneyMiner is a bash script that automates the installation of a crypto currency mining tool (minergate-cli) and a honeypot agent (honeydb-agent) on remote servers, per its documentation.
NetworkCloudHoneypot