Open software—
Material reviewed: Repository documentationMedium-interaction SSH honeypot documented to log brute-force attacks and shell sessions, with a fake filesystem.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationA Python tool that simulates an IoT device (router) to log attacker IP addresses and activity into a logfile and MySQL database, using cloned web pages as a decoy front end.
IoTNetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationkippo-extra is a set of additional fake commands (gcc, iptables, netstat, etc.) for the Kippo SSH honeypot, intended to make attacker sessions more realistic.
NetworkEndpointHoneypotDecoy
Open software—
Material reviewed: Repository documentationMedium-interaction SSH honeypot that simulates users and a shell to observe attacker commands; it documents downloading requested files to a separate directory for analysis.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationA low-interaction honeypot that spoofs service banners across thousands of ports using the nmap-service-probes file format, with support for TCP and UDP protocols, including SSL-wrapped ones.
NetworkHoneypotDecoy
Service—
Material reviewed: Public pageDecoy and response service published by QUIRSO for organizations in Germany.
NetworkDecoy
Service—
Material reviewed: Public pageManaged honeypot and decoy offering published by Cyber Fidelity.
NetworkHoneypotDecoy
Service—
Material reviewed: Public pageDeception operated by LastNode, according to its service page.
NetworkHoneypotDecoy
Service—
Material reviewed: Public pageManaged deception offering that Wipro describes in partnership with Acalvio.
NetworkIdentityDecoy
Service—
Material reviewed: Public pageCritical readingAcalvio datasheet describing cloud-hosted and managed external decoys with STIX intelligence sharing.
CloudDecoy
Framework or guide—
Material reviewed: Public pageCritical readingKnowledge base of defensive techniques with terminology related to decoys.
NetworkDecoy
Product—
Material reviewed: Public pageCritical readingCommercial identity protection component deploying endpoint deceptions to alert on lateral movement, according to Proofpoint.
EndpointIdentityDecoyHoneytoken
Open software—
Material reviewed: Repository documentationAn experimental and incomplete alpha-stage program that tracks decoy ('honey pot') files with names, extensions, and paths likely to be encrypted by ransomware, killing processes that lock them when opened.
EndpointDecoy
Framework or guide—
Material reviewed: Repository documentationEducational project combining a Snort-based IPS on a software-defined network (SDN) with OpenFlow, capable of dynamically redirecting suspicious traffic to a honeypot server for analysis instead of outright blocking it.
NetworkHoneypotDecoy
Product—
Material reviewed: Public pageCritical readingCommercial deception portfolio for identity, cloud and networks, according to Acalvio documentation.
IdentityCloudDecoyHoneytoken
Product—
Material reviewed: Public pageCritical readingDecoy-based targeted threat intelligence offering; Acalvio describes managed and appliance delivery.
CloudNetworkDecoyHoneytoken
Framework or guide—
Material reviewed: Repository documentationSpamtrap is a Rails gem that protects forms from spambots through opt-in, combinable mechanisms including hidden honeypot fields, nonces, field name mutation, and a minimum fill-time check.
ApplicationHoneypotDecoy
Product—
Material reviewed: Public pageCritical readingCommercial platform using decoys for detection and threat intelligence, according to CounterCraft.
NetworkCloudDecoyAdversary engagement
Open software—
Material reviewed: Repository documentationA historical Linux honeypot that listens on unused ports via xinetd and netfilter/REDIRECT, providing phony responses to attacker commands to consume their resources and complement IDS systems like Snort.
NetworkHoneypotDecoy
Product—
Material reviewed: Public pageCritical readingCommercial deception platform with published cloud case studies.
CloudHoneytokenDecoy
Paper—
Material reviewed: AbstractThe thesis proposes an authentication framework combining multi-factor authentication with honeytoken-based deception techniques. It describes three successive architectures: static honeytokens to improve detection of compromised credentials, the 2FHA mechanism combining one-time passwords (Google Authenticator) with honeytokens, and a final architecture with session-bound honeytokens, blockchain-supported auditing, and smart contracts on Ethereum.
IdentityApplicationHoneytokenDecoy
Open software—
Material reviewed: Repository documentationHoneypot that emulates a default Belkin N300 wireless router administration interface to observe traffic directed at home routers.
NetworkIoTHoneypotDecoy
Open software—
Material reviewed: Repository documentationAn internal web honeypot built with Django and Docker, designed to capture APT activity and insider intrusions using a decoy login interface.
ApplicationHoneypotDecoy
Open software—
Material reviewed: Repository documentationTools for cloning webpages, particularly login pages, and serving them as decoys. The documentation says the server reports requests to a syslog server.
ApplicationDecoy