What we know
A high-interaction client honeypot for Windows that, per its documentation, detects zero-day exploits and shellcodes in browsers and office applications using exploitation-stage detection methods rather than signatures, without infecting the system.
Evidence limits
The described capabilities (ROP detection, malware dumping, bypass protection) are documented by the author in an early beta release and have not been independently verified; the author acknowledges known weaknesses, including possible bypass methods and lack of detection for logical Java exploits.
Sources and provenance
- mcedp
archived-repository-primary-page · 2026-10-04
Reviewed: 2026-10-04. This record may change when new evidence is found.