Open software—
Material reviewed: Repository documentationA C program that listens for incoming SSH connections and logs the IP address, username, and password used, written to gather rudimentary intelligence on brute force attacks.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA simple Python SSH server that logs all username/password combinations attempted against it to a logfile, intended to be deployed on a redirected port via iptables.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationModified OpenSSH daemon that forwards commands to Cowrie to interpret interactions and log brute-force attacks and SSH sessions.
NetworkHoneypotAdversary engagement
Open software—
Material reviewed: Repository documentationHigh-interaction SSH proxy described as a honeypot: it sits between a connecting party and a real SSH server and logs connections.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationLow-interaction SSH honeypot that accepts connections, records authentication attempts, and reports authentication failure.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationSSH honeypot that poses as a server and logs connection attempts, including IP, username, password, and client version. The documentation says it goes no further than logging.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationMiddleware for PHP applications that adds a hidden form field as a spambot trap and checks whether it was changed.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationStarC is a documented high-interaction client honeypot for traffic analysis of Drive-by Download attacks, orchestrating a vulnerable Windows VM alongside traffic capture tools such as Wireshark and Fiddler.
EndpointNetworkHoneypot
Open software—
Material reviewed: Repository documentationGo-based SSH honeypot with a fake shell and virtual filesystem; its documentation describes session recording, SFTP/SCP transfers, and JSON activity logs.
NetworkHoneypotAdversary engagement
Open software—
Material reviewed: Repository metadataCritical readingPlatform combining multiple honeypots and analysis tools in one deployment.
NetworkIoTHoneypot
Open software—
Material reviewed: Repository documentationScripts and Splunk apps for deploying Cowrie and analyzing attacker-session logs; it provides honeypot infrastructure rather than being a honeypot itself.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationThe repository describes a simple Telnet honeypot; the supplied code shows a TCP server listening on port 23 and accepting connections.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationProgram that presents a Telnet response intended to elicit login attempts and logs the IP addresses and credentials used; its documentation frames this as tracking Mirai.
NetworkHoneypot
Product—
Material reviewed: Public pageCritical readingCommercial platform using decoys for detection and threat intelligence, according to CounterCraft.
NetworkCloudDecoyAdversary engagement
Product—
Material reviewed: Public pageCritical readingCommercial decoy product for detecting interactions with systems that appear legitimate.
NetworkIdentityHoneypotHoneytoken
Open software—
Material reviewed: Repository documentationAgent that, according to the README, emulates multiple network services, captures interactions, and sends data to threat.gg via gRPC.
NetworkCloudHoneypot
Open software—
Material reviewed: Repository documentationThug is a Python low-interaction honeyclient that mimics the behavior of a web browser to detect and emulate malicious content.
EndpointNetworkHoneypot
Open software—
Material reviewed: Repository documentationA historical Linux honeypot that listens on unused ports via xinetd and netfilter/REDIRECT, providing phony responses to attacker commands to consume their resources and complement IDS systems like Snort.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationThe repository is named “Tom's Honey Pot,” and the source code excerpt shows Protocol/DatagramProtocol classes that emulate network services (MSSQL, Terminal Services, RAdmind, VNC, SIP) listening on known TCP/UDP ports, posting Twitter alerts when connections or login attempts occur.
NetworkHoneypot
Product—
Material reviewed: Public pageCritical readingCommercial deception platform with published cloud case studies.
CloudHoneytokenDecoy
Open software—
Material reviewed: Repository documentationHoneypot documented as cloning an LXC container for a remote address and forwarding its connections there; it describes monitoring traffic and disk changes.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationTwisted-based SSH, FTP and Telnet honeypot services that store credentials in a local MySQL database.
NetworkHoneypot
Paper—
Material reviewed: AbstractThe thesis proposes an authentication framework combining multi-factor authentication with honeytoken-based deception techniques. It describes three successive architectures: static honeytokens to improve detection of compromised credentials, the 2FHA mechanism combining one-time passwords (Google Authenticator) with honeytokens, and a final architecture with session-bound honeytokens, blockchain-supported auditing, and smart contracts on Ethereum.
IdentityApplicationHoneytokenDecoy
Open software—
Material reviewed: Repository documentationHoneypot configurable by service, port, and response; the documentation says it logs events to syslog.
NetworkHoneypot