What we know
mehrai is a Docker-based honeypot whose purpose is catching Mirai binaries, using an Alpine Linux image to mimic an IoT device and monitoring the filesystem and processes to collect samples and submit them to the Viper API.
Evidence limits
The description reflects behavior as documented by the project author, including noted instability and required manual interaction; it has not been independently verified.
Sources and provenance
- compoterhacker/mehrai repository
repository-documentation · 2026-10-04
Reviewed: 2026-10-04. This record may change when new evidence is found.