Open software—
Material reviewed: Repository documentationLaravel package that adds a hidden field and encrypted timestamp to forms to identify likely bot submissions.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationA low-interaction network honeypot written in Rust that emulates SSH, FTP, and Telnet protocols, captures credentials, and provides a real-time dashboard with attack visualization and geolocation.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA Ubuntu-based Docker image that sets up an SSH honeypot, logging usernames and passwords used by attackers during login attempts, based on code and instructions from an external tutorial.
NetworkIdentityHoneypot
Service—
Material reviewed: Public pageCritical readingSaaS honeypot and deception-signal offering published by Sprint IT Solutions; operational terms await assessment.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA module for pH7CMS that presents a fake admin panel to lure and log attackers, leveraging the CMS's built-in analytics tracking.
ApplicationHoneypotDecoy
Open software—
Material reviewed: Repository documentationDocumented ExpressionEngine extension that adds a hidden honeypot field to comment and user forms to block automated spam submissions without using a CAPTCHA.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationA Drupal module that adds a hidden honeypot field and a time-based restriction to forms in order to detect and block automated spam submissions.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationProof-of-concept observation-camera honeypot documenting a watermark, daylight intensity, and automatic refresh.
IoTHoneypot
Open software—
Material reviewed: Repository documentationNode.js honeypot that emulates the TCP-32764 router backdoor and provides logs for monitoring.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA collection of support scripts for honeypots, minimally described in its documentation.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA script for Ubuntu 12.04 that automatically installs and configures Kippo, Dionaea, and p0f as system services, changing the SSH port and turning the host into a honeypot.
NetworkHoneypot
Framework or guide—
Material reviewed: Repository documentationhoneypot_recipes is a Chef cookbook that automates deployment of activity-monitoring tools (Sysdig and Falco) on Linux systems to support high-interaction honeypots, capturing and logging system calls. The tools themselves are monitoring infrastructure, not a honeypot: they provide logging and detection support used alongside a high-interaction honeypot.
NetworkEndpoint
Open software—
Material reviewed: Repository documentationFlask site for displaying data collected by an SSH honeypot, including attempts and statistics. It is deception-adjacent visualization software, not itself described as a honeypot.
Network
Open software—
Material reviewed: Repository documentationExample of using honeypots with a Standalone model and a model with the Joomla CMS for PHP applications.
ApplicationHoneypot
Dataset or lab—
Material reviewed: Repository documentationhoneypotwordlist is a collection of two wordlists of credentials: one containing all passwords sorted and unique, and another containing credentials in username:password format, sorted and unique.
Network
Open software—
Material reviewed: Repository documentationHoneyPress is a WordPress honeypot shipped in a Docker container, documented with a Flask/Python reimplementation simulating a WordPress install, logging access via Nginx, and storing captured payloads (including IP, user-agent, and commands) in a MongoDB database.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationPrinter honeypot proof of concept.
Honeypot
Open software—
Material reviewed: Repository documentationLow-interaction honeypot with plugins that can emulate TCP or UDP services and log activity. The project states it is no longer actively developed.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA simple web application honeypot that uses SimpleHTTPServer to serve a retro-styled HTML page, intended to attract and log basic web interactions.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationDocker Compose configurations and scripts for deploying Honeysat components. The README links its submodules to a honeypot system but does not present the deployment repository itself as a honeypot.
Honeypot
Open software—
Material reviewed: Repository documentationExtensible SSH honeypot written in Go using crypto/ssh to accept connections and log failed login attempts, including usernames and passwords. It supports dropping process privileges and includes a Lua-based plugin engine to process captured information, plus a virtual filesystem to more convincingly emulate a system.
NetworkEndpointHoneypot
Open software—
Material reviewed: Repository documentationSystem integrating multiple client honeypots and a crawler to process URLs and detect malicious websites.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationSSH honeypot that logs username and password attempts during brute-force attacks, rejecting them with a wrong-password message. Includes statsd, a simple HTTP API for querying login attempts.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA bash script for CentOS that combines Apache, Cloudflare, and a CMS (mainly WordPress) to detect malicious requests in server logs and temporarily block the attacker's real IP via the Cloudflare API.
ApplicationNetworkDecoy