Honeypots

SSH and Telnet

Cowrie

A well-known medium-interaction honeypot for observing credential stuffing and shell activity.

cowrie.orgLow friction

OpenCanary

Simple to stand up and useful when you want quick alerting across emulated services.

github.com/thinkst/opencanaryAll-in-one

T-Pot

A broad honeypot platform that bundles multiple sensors and dashboards into one deployment.

github.com/telekom-security/tpotceMalware capture

Dionaea

Focused on trapping malware and collecting samples from attacker interactions across exposed services.

github.com/dinotools/dionaea

Specialized and Protocol-Focused

ICS / SCADA

Conpot

A classic industrial-control honeypot when you want to observe activity aimed at ICS and OT-flavored services.

github.com/mushorg/conpotCredential capture

Heralding

Credential-focused deception across multiple protocols when you mainly care about authentication attempts and password reuse.

github.com/johnnykv/heraldingAndroid exposure

ADBHoney

Useful for catching scans and abuse aimed at exposed Android Debug Bridge services and related opportunistic activity.

github.com/huuck/ADBHoney

Web and App Deception

Web app honeypot

Glastopf

A classic web-application honeypot for collecting attack traffic aimed at vulnerable-looking HTTP targets.

github.com/mushorg/glastopfHTTP deception

Snare

Useful when you want a more modern reactive web honeypot approach for capturing attacker interaction patterns.

github.com/mushorg/snareEvent analysis

Tanner

Pairs with reactive web honeypots to analyze and enrich captured attack traffic and request behavior.

github.com/mushorg/tannerCommon web target

phpMyAdmin Honeypot

A focused trap for one of the most commonly probed web admin surfaces, useful for noisy internet-facing environments.

github.com/gfoss/phpmyadmin_honeypot

Database and Backend Services

Elasticsearch

ElasticPot

Useful for catching abuse and reconnaissance aimed at exposed Elasticsearch services and related CVE-driven scans.

gitlab.com/bontchev/elasticpotElasticsearch

Elastic honey

A lightweight Elasticsearch decoy that works well when you want a simpler trap for common backend-service probing.

github.com/jordan-wright/elastichoney

Lightweight Deception and Tarpits

Flexible framework

Honeytrap

A versatile honeypot framework for teams that want more control over services, workflows, and custom deception setups.

github.com/honeytrap/honeytrapSSH tarpit

Endlessh

Very lightweight and very funny in practice: it traps opportunistic SSH noise without needing a full interactive honeypot stack.

github.com/skeeto/endlesshLow interaction

HoneyPy

A general-purpose low-interaction honeypot that is nice when you want a flexible, lightweight starting point.

github.com/foospidy/HoneyPy

Mail, Amplification, and Other Niche Sensors

SMTP

Mailoney

A lightweight SMTP honeypot that is handy for capturing opportunistic spam and email-service probing.

github.com/phin3has/mailoneyAmplification abuse

ddospot

Focused on UDP-based amplification traffic, which makes it useful for studying noisy infrastructure abuse at the edge.

github.com/aelth/ddospotHealthcare protocols

medpot

Useful for research around HL7 and FHIR probing when you want a honeypot for healthcare-adjacent exposure.

github.com/schmalle/medpot

Multi-Service and Large Deployments

Multi-service

HoneyDB Sensor

Easy to deploy when you want a broader internet-facing sensor that can also contribute interaction data upstream.

honeydb.ioModular framework

Honeygrove

A multi-purpose modular honeypot for teams that want broader service coverage and a more research-friendly framework.

github.com/UHH-ISS/honeygroveDeployment orchestration

Community Honey Network

Helpful when you want easier distributed honeypot deployment and centralized management without wiring everything together by hand.

communityhoneynetwork.readthedocs.ioMany protocols

qeeqbox honeypots

A broad package of protocol-specific honeypots that is handy when you want many quick decoys from one place.

github.com/qeeqbox/honeypots

Cloud, Scanner, and Infrastructure Traps

Scanner noise

Masscanned

Great for studying broad internet scanning and bot noise, especially if you want a self-hosted alternative to generic scan telemetry.

github.com/ivre/masscannedRouter and home edge

WAPot

Useful for observing traffic aimed at consumer-router style exposure and home-network edge devices.

github.com/MakoWish/Faitour2

Shoutout to community-maintained lists like Awesome Honeypots, which are genuinely helpful when you want to compare niche sensors and discover smaller projects that deserve more eyeballs.