Service—
Material reviewed: Public pageCritical readingACSG publishes a managed decoy and continuous-monitoring offering for IT, cloud and ICS.
NetworkCloudDecoyHoneytoken
Service—
Material reviewed: Public pageManaged offering DALEO publishes in conjunction with the CounterCraft platform.
NetworkDecoyAdversary engagement
Service—
Material reviewed: Public pageCritical readingECCA offering in Egypt and GCC listing integration, independent services, training and managed deception.
NetworkIdentityDecoy
Product—
Material reviewed: Public pageCritical readingPersistent instrumented environments for malware detonation and adversary observation, according to the platform description.
NetworkEndpointDecoyAdversary engagement
Service—
Material reviewed: Public pageManaged IT and OT deception service published by MainDefense.
OT/ICSNetworkDecoy
Open software—
Material reviewed: Repository documentationSSH tarpit that slowly sends an endless banner to tie up connecting SSH clients while the real SSH server uses another port.
NetworkAdversary engagementDecoy
Case study—
Material reviewed: Public pageCritical readingEnergy company Shadow adoption story published by Proofpoint; investigation-time reduction is a customer statement reported by the vendor.
EndpointIdentityDecoy
Open software—
Material reviewed: Repository documentationRuby on Rails gem plugin documenting honey traps and configurable responses to detect and respond to malicious behavior in an application.
ApplicationDecoyAdversary engagement
Open software—
Material reviewed: Repository documentationA Python honeypot that listens on all TCP and UDP ports, emulating services such as SSH, telnet, SMTP, HTTP/HTTPS, SIP (with sipvicious scan detection), and a Netis router factory backdoor, logging unrecognized traffic in hexdump-like form.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationProtocol server simulator documenting fake network services, interactions, and traffic logging, including industrial protocols.
NetworkOT/ICSDecoy
Product—
Material reviewed: Public pageCritical readingCommercial decoy and breadcrumb platform for network, identity and cloud, according to Fidelis.
NetworkIdentityDecoyHoneytoken
Product—
Material reviewed: Public pageCritical readingFortinet platform for deploying decoy assets and alerting on their use.
NetworkOT/ICSDecoyHoneypot
Case study—
Material reviewed: Public pageCritical readingCounterCraft describes a bank API digital twin that attracted an attack within 30 days; outcome attributed to the vendor.
ApplicationCloudDecoy
Open software—
Material reviewed: Repository documentationDecoy software documenting bounded simulated responses for Kubernetes and Docker APIs, Ollama and other AI APIs, a misconfigured kubelet, and HTTP probes; it records TCP and UDP interactions without replying. It supports synthetic Secret honeytokens.
CloudNetworkHoneypotHoneytoken
Product—
Material reviewed: Repository documentationHFish is a free, community-oriented honeypot product developed by Beijing Microstep Online Technology Co., Ltd., aimed at enterprise scenarios such as internal lateral-movement detection, external threat perception, and intelligence generation. Its documentation states it supports over 90 honeypot service types, a B/S architecture with a server (管理端) and node/client (节点端) component, and multiple alert channels (email, syslog, webhook, WeChat Work, DingTalk, Feishu).
NetworkApplicationHoneypotDecoy
Open software—
Material reviewed: Repository documentationProof-of-concept tool that places breadcrumbs and decoys, such as fake files and credentials, on servers and workstations to draw attackers toward traps. It is not presented as a honeypot itself.
EndpointIdentityHoneytokenDecoy
Open software—
Material reviewed: Repository documentationA Windows tool that creates breadcrumbs and honeytokens, such as fake credentials in Windows Credential Manager, to lead attackers toward honeypots.
EndpointIdentityHoneytokenDecoy
Open software—
Material reviewed: Repository documentationHoneyd is a small daemon that creates virtual hosts on a network, capable of running arbitrary services and adapting their TCP personality to simulate operating systems, enabling a single host to claim multiple addresses for network simulation.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationDaemon that creates virtual network hosts and can simulate services and TCP personalities to appear as different operating systems, per the project's documentation.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationServerless application that creates and monitors fake HTTP endpoints for use as URL honeytokens; its documentation describes deployment with AWS Lambda and API Gateway.
ApplicationCloudHoneytokenDecoy
Open software—
Material reviewed: Repository documentationBash and Python scripts that listen on a decoy port and can block a connecting source IP. They do not simulate a full application or protocol.
NetworkDecoy
Open software—
Material reviewed: Repository documentationA module for pH7CMS that presents a fake admin panel to lure and log attackers, leveraging the CMS's built-in analytics tracking.
ApplicationHoneypotDecoy
Open software—
Material reviewed: Repository documentationA bash script for CentOS that combines Apache, Cloudflare, and a CMS (mainly WordPress) to detect malicious requests in server logs and temporarily block the attacker's real IP via the Cloudflare API.
ApplicationNetworkDecoy
Open software—
Material reviewed: Repository documentationMedium-interaction SSH honeypot with multiple virtual hosts, sandboxed filesystems, and commands that simulate interactions between hosts.
NetworkHoneypotDecoy