Open software—
Material reviewed: Repository documentationTool shown running against a sample malicious page or URL, with shellcode and heap-spray alerts in the example output. The README does not identify it as a honeypot.
Application
Open software—
Material reviewed: Repository documentationOpen ESP8266 firmware that advertises a decoy Wi-Fi network, observes device connections and DNS requests, and describes Telegram alerts for triggers. It is documented as software flashed to generic hardware.
Honeypot
Open software—
Material reviewed: Repository documentationA Go tool that sets up a decoy (honeypot) port and executes a configurable command against every IP that connects to it, described by the author as suited for informal settings like conferences.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationPre-alpha honeypot daemon documented to filter and redirect SSH traffic to a protocol handler and then to a sandbox if the connection is accepted.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA lightweight package described as a minimal-interaction honeypot, combining a Python port-listening script with a PHP web backend to log incoming connections.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationA script that uses Docker to quickly deploy several honeypots (Conpot, Cowrie, Heralding, Honeyaml, among others) exposing multiple services for research and reconnaissance.
NetworkOT/ICSHoneypot
Product—
Material reviewed: Public pageCritical readingCommercial identity protection component deploying endpoint deceptions to alert on lateral movement, according to Proofpoint.
EndpointIdentityDecoyHoneytoken
Open software—
Material reviewed: Repository documentationHistorical project described by Honeynet as a high-interaction client honeypot for malicious-code execution detection and prevention.
Honeypot
Open software—
Material reviewed: Repository documentationA tool and library for intercepting RDP connections; the documentation describes credential logging and session replay. It can support observation of actors but is not presented as a honeypot.
Network
Open software—
Material reviewed: Repository documentationAn experimental and incomplete alpha-stage program that tracks decoy ('honey pot') files with names, extensions, and paths likely to be encrypted by ransomware, killing processes that lock them when opened.
EndpointDecoy
Open software—
Material reviewed: Repository documentationRDP honeypot that assigns a virtual machine to each session and documents disk and traffic capture for BlueKeep telemetry.
NetworkHoneypot
Case study—
Material reviewed: Public pageCritical readingCloud deception adoption story published by the vendor Tracebit.
CloudHoneytoken
Framework or guide—
Material reviewed: Repository documentationEducational project combining a Snort-based IPS on a software-defined network (SDN) with OpenFlow, capable of dynamically redirecting suspicious traffic to a honeypot server for analysis instead of outright blocking it.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationFraud-detection tool that receives attempted calls and SIP probes, recording source IPs and dialed numbers for alerts and lookup. Its deception link is allowing and observing those attempts.
NetworkAdversary engagement
Open software—
Material reviewed: Repository documentationWeb application honeypot implemented as a Java servlet; documentation mentions GET/POST handling and a self-learning approach.
ApplicationHoneypot
Product—
Material reviewed: Public pageCritical readingCommercial deception portfolio for identity, cloud and networks, according to Acalvio documentation.
IdentityCloudDecoyHoneytoken
Product—
Material reviewed: Public pageCritical readingDecoy-based targeted threat intelligence offering; Acalvio describes managed and appliance delivery.
CloudNetworkDecoyHoneytoken
Open software—
Material reviewed: Repository documentationWeb-application honeypot designed to detect attempts to exploit the Bash remote-code vulnerability CVE-2014-6271.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationA script for visualizing statistics from a Shockpot honeypot that logs to PostgreSQL. It is a frontend for honeypot data, not itself a honeypot.
Open software—
Material reviewed: Repository documentationProject described as a honeypot network. The supplied instructions cover startup and configuration of Snort, an alert rule, and MySQL, but do not explain how the honeypots operate.
NetworkHoneypot
Open software—
Material reviewed: Repository metadataCritical readingReactive web honeypot component developed by the mushorg team.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationTool described as an open-relay simulator for spam capture and analysis.
NetworkHoneypot
Framework or guide—
Material reviewed: Repository documentationSpamtrap is a Rails gem that protects forms from spambots through opt-in, combinable mechanisms including hidden honeypot fields, nonces, field name mutation, and a minimum fill-time check.
ApplicationHoneypotDecoy
Open software—
Material reviewed: Repository documentationLow-interaction SSH honeypot that logs incoming IP addresses, usernames, and passwords without allowing logins.
NetworkHoneypot