Cowrie SSH/Telnet Honeypot https://docs.cowrie.org/

Discontinued. Fork at your will.

HPone - Docker Honeypot Manager

Cowrie Docker GitHub repository

A script using Docker to quickly bring up some honeypots exposing lots of services. For research, reconnaissance, and fun. (DISCLAIMER may not be fun, not to be taken internally, aim away from face)

A simple log viewer for cowrie

Malware written in bash to serve as an initial dropper script that will provide a strong foothold on the target device via reverse shells and persistence techniques, can be set to run via user interaction or coupled with a bot.

Parse cowrie honeypot logs into a neo4j database

Multi-honeypot deployment platform with centralized logging - Deploy Cowrie SSH, Elasticpot, and Redis honeypots on Kubernetes with Elastic Stack monitoring

The goal of Engaged Threat is to provide honeypot researchers the ability to hold the attention of an attacker or to induce the attacker to participate in some sort of increased activity.

A cloud-native honeypot system built using Cowrie on Amazon EC2, designed to attract, log, and analyze malicious behavior. Leveraging AWS services including S3, CloudWatch, Lambda, and DynamoDB.

A self-hosted honeypot deployment platform that simplifies honeypot creation and management for security professionals, researchers, and educational institutions.

Kubernetes for Cowrie

Openproxy型ハニーポット

Provides at-a-glance info from the Cowrie honeypot JSON logs

Ansible project to set up cowie, a ssh honeypot, and extract auth tries and established session information.

Multi-task NLP on Cowrie honeypot attacker-session logs—classification, QA, summarization & remediation; Flask/Django integration.

A containerized SSH Honeypot (Cowrie) lab featuring a custom-engineered Python/Streamlit SIEM. Designed to simulate and analyze internal network breaches over ZeroTier with lightweight real-time forensics.

An automated honeypot network using Ansible.

Majal's server-related codes

Ansible configuration for Cowrie. This is work in progress for Cowrie infrastructure

MIP - a malware investigation framework for extracting IOCs from honeypots

The National Cyber Threat Intelligence Hub collects, processes, and visualizes cyber threat data in real time.

Potbuster is a tool for detecting SSH honeypots. It runs multiple checks to identify potential honeypot servers, including banner analysis, connection delay, invalid command responses, and more. This tool is useful for security testing of SSH servers to uncover possible traps or suspicious behavior.

Voiphoney that Imulates D-Link DPH-150S VoIP phone and runs in docker container. It writes logs for Kibana in json and for human in log files. SIP Server - Python3, HTTP server - node.js, Telnet - cowrie, OSFooler - python2. Full size of image 512 Mb

SSH Honeypot & SIEM Analysis

Built and deployed a simulated enterprise network for threat hunting analysis and network monitoring utilising pfSense, Suricata, Cowrie, Wazuh, and Kali Linux.

HoneyNet cloud-native en AWS — Threat Intelligence automatizada · MITRE ATT&CK · ~7 días de operación

REST API for Cowrie SSH honeypot stats. Built with Rust (Axum) and Docker.

Off-box publisher stack for T-Pot + Cisco ASA that turns SSH / ADBHoney / ASA / full-honeypot telemetry into chunky, deduped AlienVault OTX pulses (IPs, URLs, hashes). Runs on its own VM over an SSH tunnel, with systemd’d schedulers and an AI-assisted brain doing the enrichment, tagging, and monthly “big boi” pulse rollups for you.