What we know
Documented honeypot for CVE-2017-5689: a web server listens on TCP port 16922 and imitates the Intel AMT management service. If exploited, it serves the attacker content obtained from an HP machine.
Evidence limits
Behavior is based on an archived README and has not been independently verified; current repository availability is unknown.
Sources and provenance
- AMTHoneypot
archived-repository-primary-page · 2026-10-04
Reviewed: 2026-10-04. This record may change when new evidence is found.