What we know
Honeypot documented as cloning an LXC container for a remote address and forwarding its connections there; it describes monitoring traffic and disk changes.
Evidence limits
Behavior is documented, not independently verified; the project describes itself as a proof of concept that has not been adequately tested.
Sources and provenance
- dutchcoders/troje repository
repository-documentation · 2026-10-04
Reviewed: 2026-10-04. This record may change when new evidence is found.