Open software—
Material reviewed: Repository documentationGo-based SSH honeypot that, according to its documentation, accepts credentials, presents a fake shell, and records attempted commands.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationDocumented integration of Conpot with GridLAB-D for a demonstration using a power-grid model and the “gridpot” template. GridLAB-D supplies the simulation; it is not presented as a honeypot itself.
OT/ICS
Open software—
Material reviewed: Repository documentationDecoy software documenting bounded simulated responses for Kubernetes and Docker APIs, Ollama and other AI APIs, a misconfigured kubelet, and HTTP probes; it records TCP and UDP interactions without replying. It supports synthetic Secret honeytokens.
CloudNetworkHoneypotHoneytoken
Product—
Material reviewed: Repository documentationHFish is a free, community-oriented honeypot product developed by Beijing Microstep Online Technology Co., Ltd., aimed at enterprise scenarios such as internal lateral-movement detection, external threat perception, and intelligence generation. Its documentation states it supports over 90 honeypot service types, a B/S architecture with a server (管理端) and node/client (节点端) component, and multiple alert channels (email, syslog, webhook, WeChat Work, DingTalk, Feishu).
NetworkApplicationHoneypotDecoy
Open software—
Material reviewed: Repository documentationRepository whose documentation identifies hived as a honeypot without describing its operation or environment.
Honeypot
Community or education—
Material reviewed: Repository documentationA curated GitHub list aggregating open-source honeypot resources (database, web, WordPress, service, ICS/SCADA honeypots), network and data analysis tools, and deployment guides, organized by category.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationDocker-deployed honeypot for detecting port scans; documents port configuration and logging of connection attempts.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationIn-development interface for collecting and reviewing alarms from local honeypot installations and forwarding them to the DTAG early warning system. It manages alarms; it is not itself a honeypot.
Open software—
Material reviewed: Repository documentationProof-of-concept tool that places breadcrumbs and decoys, such as fake files and credentials, on servers and workstations to draw attackers toward traps. It is not presented as a honeypot itself.
EndpointIdentityHoneytokenDecoy
Open software—
Material reviewed: Repository documentationA Windows tool that creates breadcrumbs and honeytokens, such as fake credentials in Windows Credential Manager, to lead attackers toward honeypots.
EndpointIdentityHoneytokenDecoy
Framework or guide—
Material reviewed: Repository documentationHoneycomb is an open-source honeypot framework created by Cymmetria that allows running honeypots with various integrations via a public plugin library, and makes it easy to write new honeypot services.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationHoneyd is a small daemon that creates virtual hosts on a network, capable of running arbitrary services and adapting their TCP personality to simulate operating systems, enabling a single host to claim multiple addresses for network simulation.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationDaemon that creates virtual network hosts and can simulate services and TCP personalities to appear as different operating systems, per the project's documentation.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationWeb honeypot documented to create and monitor fake HTTP endpoints whose URLs can be distributed as honeytokens; it is designed for Heroku but can also run on a self-hosted server.
ApplicationCloudHoneypotHoneytoken
Open software—
Material reviewed: Repository documentationServerless application that creates and monitors fake HTTP endpoints for use as URL honeytokens; its documentation describes deployment with AWS Lambda and API Gateway.
ApplicationCloudHoneytokenDecoy
Dataset or lab—
Material reviewed: Repository documentationA dataset and analysis of 2016 logs generated by the Cowrie, Dionaea, and Glastopf honeypots, with statistics on captured passwords and access attempts.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationSMTP honeypot with configurable responses, TLS and STARTTLS support, BoltDB email storage, and an API for retrieving messages.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationMaltego transform pack for graphing Kippo honeypot data stored in MySQL. Its deception link is analysis of that data; it is not described as a honeypot.
Network
Open software—
Material reviewed: Repository documentationWeb application that visualizes a live stream of GPS locations on an SVG world map; in its described instance it consumes honeypot captures provided through hpfeeds. It displays deception data but is not described as a honeypot.
Open software—
Material reviewed: Repository documentationHoneyMiner is a bash script that automates the installation of a crypto currency mining tool (minergate-cli) and a honeypot agent (honeydb-agent) on remote servers, per its documentation.
NetworkCloudHoneypot
Open software—
Material reviewed: Repository documentationMySQL honeypot project described in a README preserved in a mirror repository.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationHoneyPi is a bash script to install and run various honeypot projects on a Raspberry Pi running Raspbian, serving as an installation guide.
NetworkIoTHoneypot
Open software—
Material reviewed: Repository documentationPowerShell script that listens on specified TCP ports, logs incoming connections, and optionally blocks suspicious IP addresses via Windows Firewall, with whitelist support and detailed logging.
EndpointNetworkHoneypot
Open software—
Material reviewed: Repository documentationBash and Python scripts that listen on a decoy port and can block a connecting source IP. They do not simulate a full application or protocol.
NetworkDecoy