Open software—
Material reviewed: Repository documentationFlask site for displaying data collected by an SSH honeypot, including attempts and statistics. It is deception-adjacent visualization software, not itself described as a honeypot.
Network
Open software—
Material reviewed: Repository documentationExample of using honeypots with a Standalone model and a model with the Joomla CMS for PHP applications.
ApplicationHoneypot
Dataset or lab—
Material reviewed: Repository documentationhoneypotwordlist is a collection of two wordlists of credentials: one containing all passwords sorted and unique, and another containing credentials in username:password format, sorted and unique.
Network
Open software—
Material reviewed: Repository documentationHoneyPress is a WordPress honeypot shipped in a Docker container, documented with a Flask/Python reimplementation simulating a WordPress install, logging access via Nginx, and storing captured payloads (including IP, user-agent, and commands) in a MongoDB database.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationPrinter honeypot proof of concept.
Honeypot
Open software—
Material reviewed: Repository documentationLow-interaction honeypot with plugins that can emulate TCP or UDP services and log activity. The project states it is no longer actively developed.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA simple web application honeypot that uses SimpleHTTPServer to serve a retro-styled HTML page, intended to attract and log basic web interactions.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationDocker Compose configurations and scripts for deploying Honeysat components. The README links its submodules to a honeypot system but does not present the deployment repository itself as a honeypot.
Honeypot
Open software—
Material reviewed: Repository documentationExtensible SSH honeypot written in Go using crypto/ssh to accept connections and log failed login attempts, including usernames and passwords. It supports dropping process privileges and includes a Lua-based plugin engine to process captured information, plus a virtual filesystem to more convincingly emulate a system.
NetworkEndpointHoneypot
Open software—
Material reviewed: Repository documentationSystem integrating multiple client honeypots and a crawler to process URLs and detect malicious websites.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationSSH honeypot that logs username and password attempts during brute-force attacks, rejecting them with a wrong-password message. Includes statsd, a simple HTTP API for querying login attempts.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA bash script for CentOS that combines Apache, Cloudflare, and a CMS (mainly WordPress) to detect malicious requests in server logs and temporarily block the attacker's real IP via the Cloudflare API.
ApplicationNetworkDecoy
Open software—
Material reviewed: Repository documentationHoneypot that simulates a modem or router with a RomPager web server and TR-069 support; it documents vulnerability emulation and communication logging.
IoTNetworkHoneypot
Open software—
Material reviewed: Repository documentationhoneyTLS is a bash script that sets up Bro (Zeek) together with a JA3 script for Bro and Nginx, used as a simple honeypot to capture JA3 hashes (SSL/TLS client fingerprints). It also documents an alternative one-liner for skimming JA3 fingerprints directly off the wire.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationLow-interaction honeypot for attacks against TCP and UDP services; documents template-based emulation, mirror mode, and proxy mode.
NetworkHoneypot
Open software—
Material reviewed: Repository metadataCritical readingOpen framework for building and operating honeypot sensors.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationLow-interaction Python honeypot that mimics network services and ports and logs access attempts.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationSSH intermediary designed for use with a high-interaction honeypot: it sits between the attacker and the honeypot and creates two SSH connections. It is not described as a standalone honeypot.
Network
Open software—
Material reviewed: Repository documentationPython 2.x Telnet honeypot that emulates the service in a chroot environment. The documentation describes options for credentials, a fake hostname, and command logging.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationMedium-interaction SSH honeypot with multiple virtual hosts, sandboxed filesystems, and commands that simulate interactions between hosts.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationAuthenticated publish-subscribe protocol with an asyncio-based broker and Python 3 client; it can carry deception-system events but is not documented as a honeypot.
Open software—
Material reviewed: Repository documentationApplication for visualizing hpfeeds logs; it is adjacent infrastructure for analyzing deception-related data, not presented as a honeypot.
Open software—
Material reviewed: Repository documentationhttpbl is a Python client package for the Project Honeypot Http:BL API, allowing queries of threat scores and visitor types for IP addresses.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationMedium-interaction SSH honeypot documented to log brute-force attacks and shell sessions, with a fake filesystem.
NetworkHoneypotDecoy