Framework or guide—
Material reviewed: Repository documentationA Django application that adds hidden honeypot fields to web forms via template tags, view decorators, and middleware, aiming to detect and block automated spam submissions.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationLow-interaction SSH honeypot packaged in a Docker container that listens on port 2222, logs IP addresses, usernames, and passwords from login attempts, and then disconnects the client.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationDocumented project implementing a Docker-based high-interaction SSH honeypot, using patched bash and OpenSSH to log commands and credentials, integrated into a larger architecture of agents and attack-detection servers.
NetworkCloudHoneypot
Open software—
Material reviewed: Repository documentationDocker-based honeypot documented as an SSH decoy on port 22, using containers and auditd logging.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationSDN honeypot with an HTTP interface that simulates a failed login without connecting to a real service; the documentation suggests checking PostgreSQL records.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationDocker container that starts a Cowrie-based SSH honeypot and enables statistics reporting to DShield.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationLow-interaction honeypot that listens for connections on a configurable port, can send a reply, and triggers event handlers, including an email handler.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationElasticPot is a honeypot that emulates an Elasticsearch service, compatible with DTAG's T-Pot environment and also available as a dockerized version.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationA Splunk app that analyzes JSON logs from the Cowrie SSH honeypot to provide dashboards and metrics on attacker engagement, aiming to observe behavioral changes when honeypot configuration settings are adjusted.
NetworkHoneypotAdversary engagement
Open software—
Material reviewed: Repository documentationA MicroPython honeypot for the ESP8266 microcontroller that emulates a Telnet server to attract and observe attack attempts against exposed Telnet devices.
IoTNetworkHoneypot
Open software—
Material reviewed: Repository documentationA toolset including an Ethereum RPC node scanner and stealer, along with an RPC node honeypot described as intended to collect attacker information.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationA collection of scripts to install and run DionaeaFR and to index Cowrie honeypot data into Elasticsearch, aiding visualization of data collected from Dionaea and Cowrie honeypots.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA Python honeypot that listens on all TCP and UDP ports, emulating services such as SSH, telnet, SMTP, HTTP/HTTPS, SIP (with sipvicious scan detection), and a Netis router factory backdoor, logging unrecognized traffic in hexdump-like form.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationFakeSSH is a dockerized SSH honeypot server written in Go that logs login attempts. Per its documentation, password authentication always fails, so no terminal access is granted to the attacker.
NetworkHoneypot
Product—
Material reviewed: Public pageCritical readingFortinet platform for deploying decoy assets and alerting on their use.
NetworkOT/ICSDecoyHoneypot
Open software—
Material reviewed: Repository metadataCritical readingWeb honeypot using a language model to generate interactions.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationHoneypot that emulates a Veeder-Root TLS-350/TLS-450 automatic tank gauge controller and logs connections and commands.
OT/ICSHoneypot
Open software—
Material reviewed: Repository documentationHoneypot described by its publisher as using generative AI to emulate services.
Honeypot
Open software—
Material reviewed: Repository metadataCritical readingWeb application honeypot recording interactions with simulated attack surfaces.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationService emulators for honeypots rewritten in Go; the README does not specify which services they emulate.
Honeypot
Open software—
Material reviewed: Repository documentationGo honeypot server documented to listen on configured ports and log details of received data to a database.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationSSH honeypot written in Go; the documentation describes configuring its port and host key and observing login attempts.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationGo-based SSH honeypot that, according to its documentation, accepts credentials, presents a fake shell, and records attempted commands.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationDecoy software documenting bounded simulated responses for Kubernetes and Docker APIs, Ollama and other AI APIs, a misconfigured kubelet, and HTTP probes; it records TCP and UDP interactions without replying. It supports synthetic Secret honeytokens.
CloudNetworkHoneypotHoneytoken