Open software—
Material reviewed: Repository documentationAn academic project that deploys a honeypot alongside an Elastic stack (Elasticsearch/Kibana) and ElastAlert, including a custom 'MITREAttack' alert that writes information according to the MITRE ATT&CK matrix for detecting and classifying attacks.
NetworkEndpointHoneypot
Open software—
Material reviewed: Repository documentationTool that parses Cowrie honeypot logs into a Neo4j database; it supports analysis infrastructure rather than being presented as a honeypot.
Documentation—
Material reviewed: Repository documentationSetup documentation for several low-interaction honeypots (dionaea, kippo, glastopf, conpot), including network configuration steps such as reconfiguring the system SSH port for kippo.
Network
Service—
Material reviewed: Public pageCritical readingACSG publishes a managed decoy and continuous-monitoring offering for IT, cloud and ICS.
NetworkCloudDecoyHoneytoken
Service—
Material reviewed: Public pageManaged offering DALEO publishes in conjunction with the CounterCraft platform.
NetworkDecoyAdversary engagement
Service—
Material reviewed: Public pageCritical readingECCA offering in Egypt and GCC listing integration, independent services, training and managed deception.
NetworkIdentityDecoy
Service—
Material reviewed: Public pageHoneypot service offering published by Maple Networks.
NetworkHoneypot
Product—
Material reviewed: Public pageCritical readingPersistent instrumented environments for malware detonation and adversary observation, according to the platform description.
NetworkEndpointDecoyAdversary engagement
Service—
Material reviewed: Public pageManaged IT and OT deception service published by MainDefense.
OT/ICSNetworkDecoy
Open software—
Material reviewed: Repository documentationDistributed low-interaction honeypot whose agents simulate services with protocol handlers and whose master receives attack information.
NetworkHoneypot
Framework or guide—
Material reviewed: Repository documentationA Laravel 5.4/5.5 package that adds hidden honeypot fields (a decoy input and an encrypted timestamp) to forms to detect and block automated spam submissions, building on prior work by Ian Landsman and Maksim Surguy.
ApplicationHoneytoken
Open software—
Material reviewed: Repository metadataCritical readingHoneypot project for observing attacks against network services.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA low-interaction honeypot, successor to nepenthes, offering emulated network services such as SMB, HTTP, FTP, TFTP, and MSSQL via embedded Python and libemu, aiming to capture copies of malware.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationDionaea is a low-interaction honeypot, successor to nepenthes, designed to trap malware exploiting vulnerabilities in network services offered to a network, with the goal of obtaining a copy of the malware.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationDionaea-Vagrant is a set of scripts and a Vagrantfile that automate deployment of a virtual machine running the Dionaea malware honeypot on Ubuntu 12.04, installing dependencies and running it as a daemon alongside p0f.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationWeb front end for the Dionaea low-interaction honeypot, with connection filters and attack graphs. It is honeypot-adjacent visualization infrastructure, not itself a honeypot.
Network
Framework or guide—
Material reviewed: Repository documentationA Django application that adds hidden honeypot fields to web forms via template tags, view decorators, and middleware, aiming to detect and block automated spam submissions.
ApplicationHoneypot
Open software—
Material reviewed: Public pageA Django application for browsing the Kippo SSH honeypot’s MySQL data in the admin panel; it is not described as a honeypot itself.
Network
Open software—
Material reviewed: Repository documentationLow-interaction SSH honeypot packaged in a Docker container that listens on port 2222, logs IP addresses, usernames, and passwords from login attempts, and then disconnects the client.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationDocker files for testing software and long-term containers. Although the repository name refers to a honeynet, the text does not explain a functional deception link or describe the files as a honeypot.
Open software—
Material reviewed: Repository documentationDocumented project implementing a Docker-based high-interaction SSH honeypot, using patched bash and OpenSSH to log commands and credentials, integrated into a larger architecture of agents and attack-detection servers.
NetworkCloudHoneypot
Open software—
Material reviewed: Repository documentationDocker-based honeypot documented as an SSH decoy on port 22, using containers and auditd logging.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationSDN honeypot with an HTTP interface that simulates a failed login without connecting to a real service; the documentation suggests checking PostgreSQL records.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationDocker container that starts a Cowrie-based SSH honeypot and enables statistics reporting to DShield.
NetworkHoneypot