HoneyScan

Passive honeypot for home networks —” detects scans, brute-force, IoT malware with zero config

Linux (Raspberry Pi, VM, bare metal) Python / Shell Network Security

HoneyScan runs silently on your network, pretending to be vulnerable devices to detect and log attack attempts.

Features

Service Emulation —” SSH, Telnet, HTTP, HTTPS, RDP, SMB, MQTT, CoAP, Modbus
Credential Capture —” Logs usernames/passwords from brute-force attempts (hashed)
IoT Malware Detection —” Identifies Mirai, Gafgyt, Hajime, Mozi variants
Network Mapping —” Discovers scanning hosts, builds attack timeline
Zero Config —” Auto-detects subnet, picks unused IPs, starts emulating
Alerting —” Email, webhook, syslog, Matrix, Discord notifications
Dashboard —” Web UI with attack map, top attackers, service stats

Quick Start

# Docker (recommended)
docker run -d --net=host --cap-add=NET_ADMIN \
  -v honeypot-data:/data \
  ghcr.io/neohiro/honeypot:latest

# Bare metal / VM
curl -fsSL https://raw.githubusercontent.com/neohiro/HoneyScan/main/install.sh | sudo bash

Emulated Services

Service	Port	Variants
SSH	22	OpenSSH, Dropbear, BusyBox
Telnet	23	BusyBox, Cisco, Huawei
HTTP	80	nginx, Apache, lighttpd, GoAhead
HTTPS	443	Self-signed certs, common CNs
RDP	3389	Windows 7/10/Server
SMB	445	Samba, Windows 10
MQTT	1883	Mosquitto, EMQX
CoAP	5683	libcoap, Californium

Deployment

Platform	Method
Raspberry Pi	`docker run` or bare metal install
VM (Proxmox, ESXi, Hyper-V)	Docker or ISO
Old laptop	`install.sh`
Cloud VPS	Docker Compose

Alerting

# config/alerts.yaml
webhooks:
  - url: "https://discord.com/api/webhooks/..."
    events: ["login_attempt", "malware_detected", "new_scanner"]
email:
  smtp: "smtp.gmail.com:587"
  to: "security@yourdomain.com"
matrix:
  homeserver: "https://matrix.org"
  room: "!roomid:matrix.org"

Data Retention

Attack logs: 90 days (configurable)
Captured credentials: 30 days (auto-hashed)
PCAP captures: 7 days (optional)

Privacy

No phone home —” All data stays on your device
No external deps —” Runs fully offline after install
GDPR-ready —” No personal data collected

Cripple-NetStrip —” Active network hardening
LANScan —” Active network scanner