Open software—
Material reviewed: Repository documentationA Python tool that simulates an IoT device (router) to log attacker IP addresses and activity into a logfile and MySQL database, using cloned web pages as a decoy front end.
IoTNetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationA Python-based honeypot designed to emulate the Mirai malware, with separate listener and C2 components, aimed at scalable and easy setup.
IoTNetworkHoneypot
Open software—
Material reviewed: Repository documentationHoneypot software that simulates embedded-device services and vulnerabilities to record requests, origins, and, where supported, payloads; includes Telnet, HTTP, and HTTPS servers.
IoTNetworkHoneypot
Open software—
Material reviewed: Repository documentationkippo-extra is a set of additional fake commands (gcc, iptables, netstat, etc.) for the Kippo SSH honeypot, intended to make attacker sessions more realistic.
NetworkEndpointHoneypotDecoy
Open software—
Material reviewed: Repository documentationA medium-interaction SSH honeypot documented to log brute-force attacks and shell interactions; it includes a fake filesystem and replayable session logs.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationMedium-interaction SSH honeypot that simulates users and a shell to observe attacker commands; it documents downloading requested files to a separate directory for analysis.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationA low-interaction honeypot that spoofs service banners across thousands of ports using the nmap-service-probes file format, with support for TCP and UDP protocols, including SSL-wrapped ones.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationHoneypot for detecting and interacting with web application exploitation attempts. Its documentation describes backend-managed sensors and static, scripted, or AI-assisted responses.
ApplicationHoneypotAdversary engagement
Open software—
Material reviewed: Repository documentationMailoney is a low-interaction SMTP honeypot that simulates a vulnerable mail server, capturing authentication attempts and logging sessions to an optional database.
NetworkHoneypot
Dataset or lab—
Material reviewed: Repository documentationMalRepo is a repository of malware samples captured via the DIONAEA honeypot, intended for security researchers to analyze and reverse engineer.
NetworkHoneypot
Service—
Material reviewed: Public pageManaged honeypot and decoy offering published by Cyber Fidelity.
NetworkHoneypotDecoy
Service—
Material reviewed: Public pageDeception operated by LastNode, according to its service page.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationA high-interaction client honeypot for Windows that, per its documentation, detects zero-day exploits and shellcodes in browsers and office applications using exploitation-stage detection methods rather than signatures, without infecting the system.
EndpointHoneypot
Open software—
Material reviewed: Repository documentationmehrai is a Docker-based honeypot whose purpose is catching Mirai binaries, using an Alpine Linux image to mimic an IoT device and monitoring the filesystem and processes to collect samples and submit them to the Viper API.
IoTEndpointHoneypot
Open software—
Material reviewed: Repository documentationDocker-based MHN subset that includes Cowrie and Dionaea honeypots connected to an hpfeeds broker to publish events.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationmicro-honeypot is described on its repository page as a simple honeypot designed to block port scanning.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationLow-interaction honeypot documented to simulate a MICROS server, detect attempts to exploit CVE-2018-2636, and report them.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationA service that provides immutable persistence for hpfeeds, normalizes data from multiple honeypot sensors (dionaea, kippo, glastopf, thug, beeswarm), and exposes the normalized data through a RESTful API.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationConfigurable honeypot that responds to expected scanner commands, such as Mirai's, to fingerprint their IP addresses; supports file and syslog output.
NetworkIoTHoneypot
Framework or guide—
Material reviewed: Repository documentationA set of Ansible playbooks to deploy and configure several existing honeypot servers (Cowrie, Mailoney, Wordpot, UDPot, iplog) alongside an open-relay Postfix mail server.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationA simple telnet honeypot created to show, in a security talk, how easy it is to code a telnet honeypot in order to recover IoT malware and observe active command and control.
IoTNetworkHoneypot
Open software—
Material reviewed: Repository documentationNGINX configuration that detects requests to bait paths and exploit probes and returns 410; optional IP blocking is documented.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationOpenFlow application for POX that detects unused IP addresses through ARP snooping and redirects traffic destined for them to a specified honeypot. It is deception-routing infrastructure, not the destination honeypot.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA platform to run private unannounced honeypots as Tor hidden services (Onion Decoys), using Docker containers combining Glastopf (HTTP) and Cowrie (SSH and Telnet), with randomly generated, unpublished onion addresses.
NetworkHoneypot