Open software—
Material reviewed: Repository documentationFraud-detection tool that receives attempted calls and SIP probes, recording source IPs and dialed numbers for alerts and lookup. Its deception link is allowing and observing those attempts.
NetworkAdversary engagement
Open software—
Material reviewed: Repository documentationWeb application honeypot implemented as a Java servlet; documentation mentions GET/POST handling and a self-learning approach.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationWeb-application honeypot designed to detect attempts to exploit the Bash remote-code vulnerability CVE-2014-6271.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationA script for visualizing statistics from a Shockpot honeypot that logs to PostgreSQL. It is a frontend for honeypot data, not itself a honeypot.
Open software—
Material reviewed: Repository documentationProject described as a honeypot network. The supplied instructions cover startup and configuration of Snort, an alert rule, and MySQL, but do not explain how the honeypots operate.
NetworkHoneypot
Open software—
Material reviewed: Repository metadataCritical readingReactive web honeypot component developed by the mushorg team.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationTool described as an open-relay simulator for spam capture and analysis.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationLow-interaction SSH honeypot that logs incoming IP addresses, usernames, and passwords without allowing logins.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA C program that listens for incoming SSH connections and logs the IP address, username, and password used, written to gather rudimentary intelligence on brute force attacks.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA simple Python SSH server that logs all username/password combinations attempted against it to a logfile, intended to be deployed on a redirected port via iptables.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationModified OpenSSH daemon that forwards commands to Cowrie to interpret interactions and log brute-force attacks and SSH sessions.
NetworkHoneypotAdversary engagement
Open software—
Material reviewed: Repository documentationHigh-interaction SSH proxy described as a honeypot: it sits between a connecting party and a real SSH server and logs connections.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationLow-interaction SSH honeypot that accepts connections, records authentication attempts, and reports authentication failure.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationSSH honeypot that poses as a server and logs connection attempts, including IP, username, password, and client version. The documentation says it goes no further than logging.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationMiddleware for PHP applications that adds a hidden form field as a spambot trap and checks whether it was changed.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationStarC is a documented high-interaction client honeypot for traffic analysis of Drive-by Download attacks, orchestrating a vulnerable Windows VM alongside traffic capture tools such as Wireshark and Fiddler.
EndpointNetworkHoneypot
Open software—
Material reviewed: Repository documentationGo-based SSH honeypot with a fake shell and virtual filesystem; its documentation describes session recording, SFTP/SCP transfers, and JSON activity logs.
NetworkHoneypotAdversary engagement
Open software—
Material reviewed: Repository metadataCritical readingPlatform combining multiple honeypots and analysis tools in one deployment.
NetworkIoTHoneypot
Open software—
Material reviewed: Repository documentationScripts and Splunk apps for deploying Cowrie and analyzing attacker-session logs; it provides honeypot infrastructure rather than being a honeypot itself.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationThe repository describes a simple Telnet honeypot; the supplied code shows a TCP server listening on port 23 and accepting connections.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationProgram that presents a Telnet response intended to elicit login attempts and logs the IP addresses and credentials used; its documentation frames this as tracking Mirai.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationAgent that, according to the README, emulates multiple network services, captures interactions, and sends data to threat.gg via gRPC.
NetworkCloudHoneypot
Open software—
Material reviewed: Repository documentationThug is a Python low-interaction honeyclient that mimics the behavior of a web browser to detect and emulate malicious content.
EndpointNetworkHoneypot
Open software—
Material reviewed: Repository documentationA historical Linux honeypot that listens on unused ports via xinetd and netfilter/REDIRECT, providing phony responses to attacker commands to consume their resources and complement IDS systems like Snort.
NetworkHoneypotDecoy