Open software—
Material reviewed: Repository documentationThe repository is named “Tom's Honey Pot,” and the source code excerpt shows Protocol/DatagramProtocol classes that emulate network services (MSSQL, Terminal Services, RAdmind, VNC, SIP) listening on known TCP/UDP ports, posting Twitter alerts when connections or login attempts occur.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationHoneypot documented as cloning an LXC container for a remote address and forwarding its connections there; it describes monitoring traffic and disk changes.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationTwisted-based SSH, FTP and Telnet honeypot services that store credentials in a local MySQL database.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationHoneypot configurable by service, port, and response; the documentation says it logs events to syslog.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA tool for creating and preparing virtual machines for Cuckoo Sandbox. Its link to deception is preparing and cloaking those analysis environments; the documentation does not present it as a honeypot.
Endpoint
Open software—
Material reviewed: Repository documentationLow-interaction VNC honeypot that listens on a port and logs responses to a static VNC authentication challenge.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationHoneypot that emulates a default Belkin N300 wireless router administration interface to observe traffic directed at home routers.
NetworkIoTHoneypotDecoy
Open software—
Material reviewed: Repository documentationAn internal web honeypot built with Django and Docker, designed to capture APT activity and insider intrusions using a decoy login interface.
ApplicationHoneypotDecoy
Open software—
Material reviewed: Repository documentationTools for cloning webpages, particularly login pages, and serving them as decoys. The documentation says the server reports requests to a syslog server.
ApplicationDecoy
Open software—
Material reviewed: Repository documentationWetland is a high-interaction SSH honeypot written in Python that uses Docker containers to provide a real Linux environment, logging brute force attempts as well as attacker shell, SCP, SFTP, exec-command, and port-forwarding sessions.
NetworkEndpointHoneypot
Open software—
Material reviewed: Repository documentationRepository documenting how to start and stop WhiteFace HoneyPot and showing rdp.yml and vnc.yml configuration files; it does not explain which services it simulates.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA script for visualizing statistics from a Wordpot honeypot that logs to PostgreSQL. It is a frontend for honeypot data, not itself a honeypot.
Open software—
Material reviewed: Repository metadataArchived GitHub repository describing a fake WordPress login and registration page intended to track bot behavior. Only repository metadata is available; the bundled readme.html is the generic WordPress file and provides no project-specific documentation.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationwp-login-honeypot is a honeypot for wordpress login.php that blacklists all clients accessing it.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationWordPress plugin documenting a decoy field in comment forms to reduce spam; it is not intended to stop trackback spam.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationx-proxy is sample code accompanying an article on developing a proxy honeypot, consisting of an agent that serves as a proxy, a server that receives and stores collected data in MongoDB, and a management console to view the gathered data.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationSSH and Telnet honeypots that present a fake shell and fake Cisco router login, respectively, and save actions to log files.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationLow-interaction honeyclient for detecting malicious websites through signatures, anomalies, and pattern matching; it documents browser emulation and script analysis.
ApplicationHoneypot