Open software—
Material reviewed: Repository documentationDocker-based honeypot documented as an SSH decoy on port 22, using containers and auditd logging.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationSDN honeypot with an HTTP interface that simulates a failed login without connecting to a real service; the documentation suggests checking PostgreSQL records.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationDocker container that starts a Cowrie-based SSH honeypot and enables statistics reporting to DShield.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationLow-interaction honeypot that listens for connections on a configurable port, can send a reply, and triggers event handlers, including an email handler.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationElasticPot is a honeypot that emulates an Elasticsearch service, compatible with DTAG's T-Pot environment and also available as a dockerized version.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationSSH tarpit that slowly sends an endless banner to tie up connecting SSH clients while the real SSH server uses another port.
NetworkAdversary engagementDecoy
Open software—
Material reviewed: Repository documentationA Splunk app that analyzes JSON logs from the Cowrie SSH honeypot to provide dashboards and metrics on attacker engagement, aiming to observe behavioral changes when honeypot configuration settings are adjusted.
NetworkHoneypotAdversary engagement
Open software—
Material reviewed: Repository documentationRuby on Rails gem plugin documenting honey traps and configurable responses to detect and respond to malicious behavior in an application.
ApplicationDecoyAdversary engagement
Open software—
Material reviewed: Repository documentationA MicroPython honeypot for the ESP8266 microcontroller that emulates a Telnet server to attract and observe attack attempts against exposed Telnet devices.
IoTNetworkHoneypot
Open software—
Material reviewed: Repository documentationRepository whose README contains only the heading '# ESP8266-wifi-honeypot', with no descriptive text. No functional capabilities are documented beyond the project name.
Open software—
Material reviewed: Repository documentationA toolset including an Ethereum RPC node scanner and stealer, along with an RPC node honeypot described as intended to collect attacker information.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationA collection of scripts to install and run DionaeaFR and to index Cowrie honeypot data into Elasticsearch, aiding visualization of data collected from Dionaea and Cowrie honeypots.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA Python honeypot that listens on all TCP and UDP ports, emulating services such as SSH, telnet, SMTP, HTTP/HTTPS, SIP (with sipvicious scan detection), and a Netis router factory backdoor, logging unrecognized traffic in hexdump-like form.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationFakeSSH is a dockerized SSH honeypot server written in Go that logs login attempts. Per its documentation, password authentication always fails, so no terminal access is granted to the attacker.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationProtocol server simulator documenting fake network services, interactions, and traffic logging, including industrial protocols.
NetworkOT/ICSDecoy
Open software—
Material reviewed: Repository metadataCritical readingWeb honeypot using a language model to generate interactions.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationHoneypot that emulates a Veeder-Root TLS-350/TLS-450 automatic tank gauge controller and logs connections and commands.
OT/ICSHoneypot
Open software—
Material reviewed: Repository documentationHoneypot described by its publisher as using generative AI to emulate services.
Honeypot
Open software—
Material reviewed: Repository metadataCritical readingWeb application honeypot recording interactions with simulated attack surfaces.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationPerl script that queries Glastopf's SQLite database for statistics. It supports analysis of a web-application honeypot but is not described as a honeypot itself.
Application
Open software—
Material reviewed: Repository documentationService emulators for honeypots rewritten in Go; the README does not specify which services they emulate.
Honeypot
Open software—
Material reviewed: Repository documentationGo honeypot server documented to listen on configured ports and log details of received data to a database.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationSSH honeypot written in Go; the documentation describes configuring its port and host key and observing login attempts.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationGo-based SSH honeypot that, according to its documentation, accepts credentials, presents a fake shell, and records attempted commands.
NetworkHoneypot