Open software2026
Material reviewed: Repository metadataEditor contributionOpen Docker Compose lab with vulnerable services, configurable deception levels, monitoring and an attacker environment for controlled training and research.
NetworkApplicationHoneypotDecoy
Open software2022
Material reviewed: Repository metadataA tool for deploying and detecting use of Active Directory honeytokens
NetworkHoneytoken
Open software—
Material reviewed: Repository documentationA honeypot project (now outdated) that deploys decoy clients and services to detect compromise via traffic discrepancies and honeytoken credential reuse.
NetworkIdentityHoneypotHoneytoken
Open software—
Material reviewed: Repository metadataCritical readingOpen project for creating decoy tokens that alert when someone uses them.
IdentityCloudHoneytoken
Open software—
Material reviewed: Repository documentationDecoy software documenting bounded simulated responses for Kubernetes and Docker APIs, Ollama and other AI APIs, a misconfigured kubelet, and HTTP probes; it records TCP and UDP interactions without replying. It supports synthetic Secret honeytokens.
CloudNetworkHoneypotHoneytoken
Open software—
Material reviewed: Repository documentationProof-of-concept tool that places breadcrumbs and decoys, such as fake files and credentials, on servers and workstations to draw attackers toward traps. It is not presented as a honeypot itself.
EndpointIdentityHoneytokenDecoy
Open software—
Material reviewed: Repository documentationA Windows tool that creates breadcrumbs and honeytokens, such as fake credentials in Windows Credential Manager, to lead attackers toward honeypots.
EndpointIdentityHoneytokenDecoy
Open software—
Material reviewed: Repository documentationWeb honeypot documented to create and monitor fake HTTP endpoints whose URLs can be distributed as honeytokens; it is designed for Heroku but can also run on a self-hosted server.
ApplicationCloudHoneypotHoneytoken
Open software—
Material reviewed: Repository documentationServerless application that creates and monitors fake HTTP endpoints for use as URL honeytokens; its documentation describes deployment with AWS Lambda and API Gateway.
ApplicationCloudHoneytokenDecoy