Open software2026
Material reviewed: Repository metadataA secure low code deception runtime framework, leveraging AI for System Virtualization.
NetworkDecoy
Open software2026
Material reviewed: Repository metadataEditor contributionOpen Docker Compose lab with vulnerable services, configurable deception levels, monitoring and an attacker environment for controlled training and research.
NetworkApplicationHoneypotDecoy
Open software2026
Material reviewed: Public pageThe statically read code defines configurable TCP bait ports that accept and close connections; it logs interactions and requests a firewall block for source IPs outside the allowlist.
NetworkHoneypotDecoy
Open software2026
Material reviewed: Repository metadataMimicry is a dynamic deception tool that actively deceives an attacker during exploitation and post-exploitation.
NetworkDecoy
Open software2026
Material reviewed: Repository metadataWebDecoy Bot Detection — zero-config WordPress plugin for bot protection, spam prevention, and WooCommerce carding defense
ApplicationDecoy
Open software2025
Material reviewed: Repository metadataEditor contributionExperimental framework generating fictitious user profiles and activity for decoy environments; the repository documents narratives, profiles and language-model integration.
EndpointNetworkDecoyAdversary engagement
Open software2025
Material reviewed: Repository metadataRepository about fake applications for attacker diversion; documentation and maintenance require further review.
ApplicationDecoy
Open software2024
Material reviewed: Repository metadataRepository about cloud-application decoys; documentation and maintenance require further review.
CloudDecoy
Open software2024
Material reviewed: Repository metadataEditor contributionOpen framework for planning deception operations and deploying decoys and services with Python and Docker, according to its repository and documentation.
NetworkApplicationDecoyHoneypot
Open software—
Material reviewed: Repository documentationA honeypot project (now outdated) that deploys decoy clients and services to detect compromise via traffic discrepancies and honeytoken credential reuse.
NetworkIdentityHoneypotHoneytoken
Open software—
Material reviewed: Repository documentationSSH tarpit that slowly sends an endless banner to tie up connecting SSH clients while the real SSH server uses another port.
NetworkAdversary engagementDecoy
Open software—
Material reviewed: Repository documentationRuby on Rails gem plugin documenting honey traps and configurable responses to detect and respond to malicious behavior in an application.
ApplicationDecoyAdversary engagement
Open software—
Material reviewed: Repository documentationA Python honeypot that listens on all TCP and UDP ports, emulating services such as SSH, telnet, SMTP, HTTP/HTTPS, SIP (with sipvicious scan detection), and a Netis router factory backdoor, logging unrecognized traffic in hexdump-like form.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationProtocol server simulator documenting fake network services, interactions, and traffic logging, including industrial protocols.
NetworkOT/ICSDecoy
Open software—
Material reviewed: Repository documentationDecoy software documenting bounded simulated responses for Kubernetes and Docker APIs, Ollama and other AI APIs, a misconfigured kubelet, and HTTP probes; it records TCP and UDP interactions without replying. It supports synthetic Secret honeytokens.
CloudNetworkHoneypotHoneytoken
Open software—
Material reviewed: Repository documentationProof-of-concept tool that places breadcrumbs and decoys, such as fake files and credentials, on servers and workstations to draw attackers toward traps. It is not presented as a honeypot itself.
EndpointIdentityHoneytokenDecoy
Open software—
Material reviewed: Repository documentationA Windows tool that creates breadcrumbs and honeytokens, such as fake credentials in Windows Credential Manager, to lead attackers toward honeypots.
EndpointIdentityHoneytokenDecoy
Open software—
Material reviewed: Repository documentationHoneyd is a small daemon that creates virtual hosts on a network, capable of running arbitrary services and adapting their TCP personality to simulate operating systems, enabling a single host to claim multiple addresses for network simulation.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationDaemon that creates virtual network hosts and can simulate services and TCP personalities to appear as different operating systems, per the project's documentation.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationServerless application that creates and monitors fake HTTP endpoints for use as URL honeytokens; its documentation describes deployment with AWS Lambda and API Gateway.
ApplicationCloudHoneytokenDecoy
Open software—
Material reviewed: Repository documentationBash and Python scripts that listen on a decoy port and can block a connecting source IP. They do not simulate a full application or protocol.
NetworkDecoy
Open software—
Material reviewed: Repository documentationA module for pH7CMS that presents a fake admin panel to lure and log attackers, leveraging the CMS's built-in analytics tracking.
ApplicationHoneypotDecoy
Open software—
Material reviewed: Repository documentationA bash script for CentOS that combines Apache, Cloudflare, and a CMS (mainly WordPress) to detect malicious requests in server logs and temporarily block the attacker's real IP via the Cloudflare API.
ApplicationNetworkDecoy
Open software—
Material reviewed: Repository documentationMedium-interaction SSH honeypot with multiple virtual hosts, sandboxed filesystems, and commands that simulate interactions between hosts.
NetworkHoneypotDecoy