explaingit

paralax/awesome-honeypots

★ 10,274PythonAudience · ops devopsComplexity · 1/5Setup · moderate

TLDR

A curated list of honeypot tools, decoy systems that attract and log attackers, organized by the type of service they fake, including databases, web apps, SSH, FTP, and industrial control systems.

Mindmap

mindmap
  root((awesome-honeypots))
    What it does
      Curated honeypot list
      Security research resource
    Honeypot types
      Database fakes
      Web app decoys
      SSH and FTP traps
      Industrial control systems
    Supporting tools
      Traffic analysis
      Log visualization
      Data pipelines
    Resources
      Research papers
      Contribution guides
Click or tap to explore — scroll the page freely

Code map

Detail Auto

An interactive map of this repo's files and how they connect — its source is parsed live in your browser. Click Visualize to build it.

filefunction / class

Things people build with this

USE CASE 1

Find an existing honeypot tool that mimics a specific service like MySQL or SSH instead of building one from scratch

USE CASE 2

Research attacker behavior by deploying a web honeypot that simulates a vulnerable WordPress or Django login page

USE CASE 3

Add decoy database services to your network to detect unauthorized port scanning or credential stuffing attempts

USE CASE 4

Explore log visualization and traffic analysis tools that process the events honeypots generate

Tech stack

Python

Getting it running

Difficulty · moderate Time to first run · 1h+

This repo is a link directory only, setup difficulty and time depend on which linked tool you choose to deploy.

In plain English

A honeypot is a decoy system or service that pretends to be a real target, designed to attract attackers and record what they do. This repository is a curated, community-maintained collection of honeypot software, organized into categories that cover databases, web applications, networking protocols, email, and more. If someone is researching how attackers behave or wants to add deceptive traps to their own infrastructure, this list is a starting point for finding existing tools rather than building from scratch. The collection is divided by the type of service being faked. Database honeypots mimic MySQL, PostgreSQL, Redis, Elasticsearch, and MongoDB so that anyone probing those ports gets logged instead of finding real data. Web honeypots simulate vulnerable applications, login pages, upload forms, WordPress installs, and Django admin screens to catch common scanning and exploitation attempts. Service honeypots cover a wide range of protocols, including SSH, FTP, VoIP, Kubernetes APIs, Android Debug Bridge, and industrial control systems, giving researchers a broad palette for monitoring different attack surfaces. Beyond the honeypots themselves, the list includes supporting tools: honeyd plugins for building more complex virtual networks, traffic analysis utilities, log visualization dashboards, and data pipelines for processing the events that honeypots generate. There are also guides and research papers included for those who want background reading on the topic before deploying anything. Most entries are open source projects hosted on GitHub or GitLab, ranging from small proof-of-concept scripts to more mature frameworks maintained by security companies and academic research groups. The list is not ranked by quality or popularity, items appear in the order contributions were made. Anyone can add a new tool by following the contributing guide linked in the repository. The list itself does not contain ready-to-use software, it links out to each project's own repository where installation instructions live. The full README is longer than what was shown.

Copy-paste prompts

Prompt 1
Which honeypot from the awesome-honeypots list would you recommend for detecting SSH brute-force attacks on a small home server, and how do I set it up?
Prompt 2
Help me choose a web honeypot from awesome-honeypots that simulates a WordPress login page and logs IPs that attempt to log in
Prompt 3
How do I set up an SSH honeypot from awesome-honeypots alongside my real SSH server on a different port so attackers hit the fake one first?
Prompt 4
What database honeypots in awesome-honeypots support MongoDB and how do I run one in Docker to log connection attempts?
Open on GitHub → Explain another repo

← paralax on gitmyhub — every repo by this author, as a profile.

Verify against the repo before relying on details.