🍯 Multi-Service Honeypot Network

Multi-pot threat intelligence infrastructure capturing attacks across SSH, HTTP, Redis, PostgreSQL and Docker services. Auto-extracts IOCs, downloads malware payloads, enumerates C2 infrastructure, and submits indicators to ThreatFox / MalwareBazaar / VirusTotal.

Operated by @NullBlue67.

Architecture

┌─────────────────────────────────────────────────────────────────┐
│                    Internet (attackers)                          │
└──────┬──────────┬──────────┬──────────┬──────────┬──────────────┘
       │          │          │          │          │
       ▼          ▼          ▼          ▼          ▼
   ┌───────┐ ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐
   │Cowrie │ │ Webpot │ │ Redis  │ │   PG   │ │ Docker │
   │  SSH  │ │ Flask  │ │  pot   │ │  pot   │ │  pot   │
   │ :22   │ │ :80/443│ │ :6379  │ │ :5432  │ │ :2375  │
   └───┬───┘ └───┬────┘ └───┬────┘ └───┬────┘ └───┬────┘
       │         │          │          │          │
       └─────────┴──────────┴──────────┴──────────┘
                       │
                       ▼
            ┌───────────────────┐
            │ Cross-pot Scoring │ ──┐
            │  (SQLite WAL)     │   │
            └───────────────────┘   │
                       │            │
                       ▼            ▼
            ┌───────────────────┐ ┌─────────────────┐
            │ Auto C2 Enumerator│ │ Telegram Alerts │
            │ (nmap, banner,    │ │ (live capture)  │
            │  WHOIS, probes)   │ └─────────────────┘
            └─────────┬─────────┘
                      │
                      ▼
            ┌───────────────────────────┐
            │ ThreatFox + MB + VT       │
            │ (auto-submit IOCs)        │
            └───────────────────────────┘

Components

File	Service	Description
app/server.py	Webpot (Flask)	Fake admin panels, AntSword shell, honeytokens, auto-fetch C2 URLs
app/redis_pot.py	Redis	Full RESP emulation, SLAVEOF/PSYNC payload capture, EVAL/CONFIG tracking
app/postgres_pot.py	PostgreSQL	Wire protocol emulation, COPY FROM PROGRAM detection, CREATE FUNCTION RCE capture
app/docker_pot.py	Docker API	Containers/create + exec exploitation logging
app/c2_enum.py	Background	Auto port-scan + banner + WHOIS + Redis/Stratum probes on captured C2 IPs
app/attacker_score.py	Background	Cross-pot APT scoring (SQLite WAL)

Features

Capture & Analysis

• 🐍 SSH (via Cowrie Docker) — SFTP/SCP malware uploads + interactive command capture
• 🌐 Webpot — fake WordPress, phpMyAdmin, Spring Boot Actuator, GitLab, Confluence, Cisco AnyConnect baits
• 🔴 Redis pot — fake state (24 plausible keys), realistic KEYS/DBSIZE/INFO/TYPE/OBJECT, captures SLAVEOF payloads via fake PSYNC
• 🐘 PostgreSQL pot — full handshake emulation, fake CREATE FUNCTION success to lure 2nd-stage payloads, multi-version banner rotation
• 🐳 Docker pot — /containers/create, /exec, nsenter, runc escape detection

Threat Intelligence

• 🛰️ Auto C2 enumeration — on every captured malicious IP: nmap top-50, banner grab, WHOIS, Redis probe, Stratum probe → JSON report + Telegram alert
• 🏆 Cross-pot APT scoring — same IP hitting multiple pots = elevated alert (score ≥ 50)
• 🍯 Honeytokens — fake AWS keys / API endpoints / webhook URLs embedded in fake .env responses; beacon URLs trigger 🍯 HONEYTOKEN TRIGGERED alerts when attackers validate stolen creds
• 📡 Auto-fetch — URLs found in attacker payloads are downloaded (SSRF-safe, size-capped, public IPs only) and hash-stored
• 🚀 Multi-platform IOC reporting — automated submission helpers for ThreatFox / MalwareBazaar / VirusTotal

Security (defensive)

• 🛡️ All pots run as non-root (www-data) — no host escape from any pot
• 🛡️ SSH/Cowrie isolated in Docker with no host bind mounts
• 🛡️ SSRF protection — blocks loopback, private nets, cloud metadata (169.254.169.254), and own VPS IP
• 🛡️ Size-capped downloads (50 MB max), no eval/exec of attacker input
• 🛡️ Filenames hashed (no path traversal possible)
• 🛡️ TLS/SSH banner rotation per session (harder fingerprinting)

Setup

Requirements

• Linux VPS (Debian 12 / Ubuntu 22.04 tested)
• Python 3.11+
• Cowrie (Docker) for SSH honeypot
• Nginx for TLS termination (optional)

Install

# Clone
git clone https://github.com/NullBlue67/honeypot-network.git /opt/webpot
cd /opt/webpot

# Python deps
python3 -m venv venv
source venv/bin/activate
pip install flask requests urllib3

# Configure
cp .env.example .env
nano .env   # Fill in your tokens + own VPS IP

# Create directories
mkdir -p captured_shells malware_samples c2_enum db logs

Systemd services

See systemd/ directory for unit files. Each pot runs as www-data.

sudo cp systemd/*.service /etc/systemd/system/
sudo systemctl daemon-reload
sudo systemctl enable --now webpot redis-pot postgres-pot docker-pot

Results (so far)

• 30+ IOCs reported to ThreatFox (elf.malxmr, elf.perlbot, elf.dofloo, elf.redtail, elf.xmrig)
• 1st-in-world capture of Outlaw dota3.tar.gz toolkit (VT/MB/TF all 404 before upload)
• Confirmed campaigns: Outlaw, Multiverze, Redtail, Junko-Enoshima

⚠️ Legal & Ethical

This is defensive research infrastructure. The honeypots:

• ❌ Do NOT counter-hack
• ❌ Do NOT send extortion / threats
• ❌ Do NOT execute captured malware
• ✅ Passively log attacker behavior on services exposed to the internet
• ✅ Perform passive reconnaissance (nmap, banner grab, WHOIS) on captured IPs — limited to scanning of public services
• ✅ Submit IOCs to community platforms (abuse.ch ThreatFox/MalwareBazaar, VirusTotal)

If you deploy this, understand the legal landscape of your jurisdiction. Honeypot legality varies. Some countries treat capturing attacker tools as borderline. Get legal advice before operating one commercially.

License

MIT — but do not use this code to attack production systems you don't own. Defensive only.

Credits

• @NullBlue67 — honeypot operator + IOC reporter
• Built on top of Cowrie for SSH
• IOC submissions via abuse.ch / VirusTotal