Open software—
Material reviewed: Repository documentationMedium-interaction SSH honeypot with multiple virtual hosts, sandboxed filesystems, and commands that simulate interactions between hosts.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationhttpbl is a Python client package for the Project Honeypot Http:BL API, allowing queries of threat scores and visitor types for IP addresses.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationMedium-interaction SSH honeypot documented to log brute-force attacks and shell sessions, with a fake filesystem.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationAn instant messenger honeypot; the documentation only describes it as 'Instant messenger honeypot', without detailing protocols or detection mechanisms.
ApplicationNetworkHoneypot
Product—
Material reviewed: Public pageCritical readingInsightIDR capabilities for honeypots, honey users, files and credentials; documentation describes interaction alerts.
NetworkIdentityHoneypotHoneytoken
Open software—
Material reviewed: Repository documentationSimple honeypot for the Intel AMT port, inspired by a SANS ISC advisory about the risk of exposed AMT. It is intended to run alongside packet capture to log activity on the relevant ports.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationScripts to install a server and multiple honeypots, process their logs, and display information about attack attempts. The documentation lists SSH, web, and industrial-system honeypots.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationA Python tool that simulates an IoT device (router) to log attacker IP addresses and activity into a logfile and MySQL database, using cloned web pages as a decoy front end.
IoTNetworkHoneypotDecoy
Community or education—
Material reviewed: Repository documentationiPot is a Chinese-language blog and community dedicated to honeypot research, aggregating open-source projects, academic papers, datasets, and research sharing on honeypot technologies; it is not itself deception software.
Network
Open software—
Material reviewed: Repository documentationA Python-based honeypot designed to emulate the Mirai malware, with separate listener and C2 components, aimed at scalable and easy setup.
IoTNetworkHoneypot
Open software—
Material reviewed: Repository documentationHoneypot software that simulates embedded-device services and vulnerabilities to record requests, origins, and, where supported, payloads; includes Telnet, HTTP, and HTTPS servers.
IoTNetworkHoneypot
Open software—
Material reviewed: Repository documentationkippo-extra is a set of additional fake commands (gcc, iptables, netstat, etc.) for the Kippo SSH honeypot, intended to make attacker sessions more realistic.
NetworkEndpointHoneypotDecoy
Open software—
Material reviewed: Repository documentationKippo-Graph is a PHP tool that visualizes statistics and charts from data collected by the Kippo SSH honeypot, including attack geolocation, but is not itself a honeypot.
Network
Open software—
Material reviewed: Repository documentationKippo-Malware is a Python script that downloads malicious files stored as URLs in the Kippo SSH honeypot's database, with support for HTTP proxies and custom User-Agent values; it is not itself a honeypot.
Network
Open software—
Material reviewed: Repository documentationA Mojolicious and DBIx::Class web application that displays statistics about the Kippo (kippo) SSH honeypot. It is not itself a honeypot.
Network
Open software—
Material reviewed: Repository documentationA medium-interaction SSH honeypot documented to log brute-force attacks and shell interactions; it includes a fake filesystem and replayable session logs.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationMedium-interaction SSH honeypot that simulates users and a shell to observe attacker commands; it documents downloading requested files to a separate directory for analysis.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationA low-interaction honeypot that spoofs service banners across thousands of ports using the nmap-service-probes file format, with support for TCP and UDP protocols, including SSL-wrapped ones.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationMailoney is a low-interaction SMTP honeypot that simulates a vulnerable mail server, capturing authentication attempts and logging sessions to an optional database.
NetworkHoneypot
Dataset or lab—
Material reviewed: Repository documentationMalRepo is a repository of malware samples captured via the DIONAEA honeypot, intended for security researchers to analyze and reverse engineer.
NetworkHoneypot
Service—
Material reviewed: Public pageDecoy and response service published by QUIRSO for organizations in Germany.
NetworkDecoy
Service—
Material reviewed: Public pageManaged honeypot and decoy offering published by Cyber Fidelity.
NetworkHoneypotDecoy
Service—
Material reviewed: Public pageDeception operated by LastNode, according to its service page.
NetworkHoneypotDecoy
Service—
Material reviewed: Public pageManaged deception offering that Wipro describes in partnership with Acalvio.
NetworkIdentityDecoy