Service—
Material reviewed: Public pageManaged deception offering that Wipro describes in partnership with Acalvio.
NetworkIdentityDecoy
Service—
Material reviewed: Public pageCritical readingAcalvio datasheet describing cloud-hosted and managed external decoys with STIX intelligence sharing.
CloudDecoy
Open software—
Material reviewed: Repository documentationDeployment script that runs Docker images of the Dionaea and Kippo honeypots; the script facilitates their setup but is not itself a honeypot.
Network
Open software—
Material reviewed: Repository documentationA high-interaction client honeypot for Windows that, per its documentation, detects zero-day exploits and shellcodes in browsers and office applications using exploitation-stage detection methods rather than signatures, without infecting the system.
EndpointHoneypot
Open software—
Material reviewed: Repository documentationmehrai is a Docker-based honeypot whose purpose is catching Mirai binaries, using an Alpine Linux image to mimic an IoT device and monitoring the filesystem and processes to collect samples and submit them to the Viper API.
IoTEndpointHoneypot
Open software—
Material reviewed: Repository documentationDocker-based MHN subset that includes Cowrie and Dionaea honeypots connected to an hpfeeds broker to publish events.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationmicro-honeypot is described on its repository page as a simple honeypot designed to block port scanning.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationLow-interaction honeypot documented to simulate a MICROS server, detect attempts to exploit CVE-2018-2636, and report them.
ApplicationHoneypot
Product—
Material reviewed: Public pageCritical readingDocumented feature tagging honeytoken accounts and devices; sign-ins generate Defender for Identity alerts.
IdentityHoneytoken
Framework or guide—
Material reviewed: Public pageCritical readingKnowledge base of defensive techniques with terminology related to decoys.
NetworkDecoy
Framework or guide—
Material reviewed: Public pageCritical readingFramework for planning and communicating denial, deception and adversary engagement.
NetworkCloudAdversary engagement
Open software—
Material reviewed: Repository documentationA service that provides immutable persistence for hpfeeds, normalizes data from multiple honeypot sensors (dionaea, kippo, glastopf, thug, beeswarm), and exposes the normalized data through a RESTful API.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationCentralized server that manages deployment of honeypot sensors (Snort, Cowrie, Dionaea, glastopf, among others) and collects their data through a web interface; MHN itself is orchestration and collection infrastructure, not a honeypot, though it supports honeypot techniques via the sensors it deploys.
Network
Open software—
Material reviewed: Repository documentationConfigurable honeypot that responds to expected scanner commands, such as Mirai's, to fingerprint their IP addresses; supports file and syslog output.
NetworkIoTHoneypot
Framework or guide—
Material reviewed: Repository documentationA set of Ansible playbooks to deploy and configure several existing honeypot servers (Cowrie, Mailoney, Wordpot, UDPot, iplog) alongside an open-relay Postfix mail server.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationA simple telnet honeypot created to show, in a security talk, how easy it is to code a telnet honeypot in order to recover IoT malware and observe active command and control.
IoTNetworkHoneypot
Open software—
Material reviewed: Repository documentationNGINX configuration that detects requests to bait paths and exploit probes and returns 410; optional IP blocking is documented.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationOpenFlow application for POX that detects unused IP addresses through ARP snooping and redirects traffic destined for them to a specified honeypot. It is deception-routing infrastructure, not the destination honeypot.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA platform to run private unannounced honeypots as Tor hidden services (Onion Decoys), using Docker containers combining Glastopf (HTTP) and Cowrie (SSH and Telnet), with randomly generated, unpublished onion addresses.
NetworkHoneypot
Open software—
Material reviewed: Repository metadataCritical readingMulti-protocol network honeypot for detecting suspicious interactions inside networks.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA web backend (Tornado+Vue+Mysql+APScheduler+Nginx+Supervisor) providing a dashboard, host status, attack list, filter lists, and mail configuration to visualize and manage events detected by the OpenCanary honeypot.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationPHP (Zend/Laminas) module providing a contact form with anti-spam protection using a hidden honeypot field.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationOpen-source Python software designed for creating honeypot and honeynet setups in an easy and secure way, compatible with Python 3.x and tested on Mac OS X and Linux, with example modules for FTP, HTTP, and SSH deployed via containers.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationAPI honeypot whose server, according to the documentation, logs attempts to the API.log file.
ApplicationHoneypot