Open software—
Material reviewed: Repository documentationAuthenticated publish-subscribe protocol with an asyncio-based broker and Python 3 client; it can carry deception-system events but is not documented as a honeypot.
Open software—
Material reviewed: Repository documentationApplication for visualizing hpfeeds logs; it is adjacent infrastructure for analyzing deception-related data, not presented as a honeypot.
Open software—
Material reviewed: Repository documentationhttpbl is a Python client package for the Project Honeypot Http:BL API, allowing queries of threat scores and visitor types for IP addresses.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationMedium-interaction SSH honeypot documented to log brute-force attacks and shell sessions, with a fake filesystem.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationAn instant messenger honeypot; the documentation only describes it as 'Instant messenger honeypot', without detailing protocols or detection mechanisms.
ApplicationNetworkHoneypot
Open software—
Material reviewed: Repository documentationSimple honeypot for the Intel AMT port, inspired by a SANS ISC advisory about the risk of exposed AMT. It is intended to run alongside packet capture to log activity on the relevant ports.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationScripts to install a server and multiple honeypots, process their logs, and display information about attack attempts. The documentation lists SSH, web, and industrial-system honeypots.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationA Python tool that simulates an IoT device (router) to log attacker IP addresses and activity into a logfile and MySQL database, using cloned web pages as a decoy front end.
IoTNetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationUnofficial PHP SDK for Project Honey Pot that queries the HttpBL API to detect bad visitors and generates Quicklinks pointing to an external honeypot. It is a client/integration SDK and does not itself implement a honeypot.
Application
Open software—
Material reviewed: Repository documentationA Python-based honeypot designed to emulate the Mirai malware, with separate listener and C2 components, aimed at scalable and easy setup.
IoTNetworkHoneypot
Open software—
Material reviewed: Repository documentationHoneypot software that simulates embedded-device services and vulnerabilities to record requests, origins, and, where supported, payloads; includes Telnet, HTTP, and HTTPS servers.
IoTNetworkHoneypot
Open software—
Material reviewed: Repository documentationkippo-extra is a set of additional fake commands (gcc, iptables, netstat, etc.) for the Kippo SSH honeypot, intended to make attacker sessions more realistic.
NetworkEndpointHoneypotDecoy
Open software—
Material reviewed: Repository documentationKippo-Graph is a PHP tool that visualizes statistics and charts from data collected by the Kippo SSH honeypot, including attack geolocation, but is not itself a honeypot.
Network
Open software—
Material reviewed: Repository documentationKippo-Malware is a Python script that downloads malicious files stored as URLs in the Kippo SSH honeypot's database, with support for HTTP proxies and custom User-Agent values; it is not itself a honeypot.
Network
Open software—
Material reviewed: Repository documentationA Mojolicious and DBIx::Class web application that displays statistics about the Kippo (kippo) SSH honeypot. It is not itself a honeypot.
Network
Open software—
Material reviewed: Repository documentationA medium-interaction SSH honeypot documented to log brute-force attacks and shell interactions; it includes a fake filesystem and replayable session logs.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationMedium-interaction SSH honeypot that simulates users and a shell to observe attacker commands; it documents downloading requested files to a separate directory for analysis.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationSoftware described as x86 emulation. That capability could be used to analyze code captured by a deception system, but the README documents neither that use nor libemu as a honeypot.
Open software—
Material reviewed: Repository documentationA low-interaction honeypot that spoofs service banners across thousands of ports using the nmap-service-probes file format, with support for TCP and UDP protocols, including SSL-wrapped ones.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationHoneypot for detecting and interacting with web application exploitation attempts. Its documentation describes backend-managed sensors and static, scripted, or AI-assisted responses.
ApplicationHoneypotAdversary engagement
Open software—
Material reviewed: Repository documentationMailoney is a low-interaction SMTP honeypot that simulates a vulnerable mail server, capturing authentication attempts and logging sessions to an optional database.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationDeployment script that runs Docker images of the Dionaea and Kippo honeypots; the script facilitates their setup but is not itself a honeypot.
Network
Open software—
Material reviewed: Repository documentationA high-interaction client honeypot for Windows that, per its documentation, detects zero-day exploits and shellcodes in browsers and office applications using exploitation-stage detection methods rather than signatures, without infecting the system.
EndpointHoneypot
Open software—
Material reviewed: Repository documentationmehrai is a Docker-based honeypot whose purpose is catching Mirai binaries, using an Alpine Linux image to mimic an IoT device and monitoring the filesystem and processes to collect samples and submit them to the Viper API.
IoTEndpointHoneypot