
sshesame
An easy to set up and use SSH honeypot, a fake SSH server that lets anyone in and logs their activity

An easy to set up and use SSH honeypot, a fake SSH server that lets anyone in and logs their activity

Lightweight web-attack monitor. One Go binary + SQLite. Not OSSEC, not a WAF.

PowerShell script that monitors Windows DNS traffic via pktmon to detect poisoning, spoofing, rogue resolver responses, and gateway MAC changes,…

A curated list of resources related to Industrial Control System (ICS) security.

pySigma OpenSearch backend

Slides from various conference talks

MysqlHoneypot

Zeek script using the official ICANN Top-Level Domain (TLD) list with the Input Framework to extract the relevant information from a DNS query and…

Top DNS Measurement for Bro

A Zeek OpenVPN protocol analyzer plugin.

Integrates your Modern Honeypot Network Server and Wordpress Blog via MHN's REST API and WP's shortcodes

Botnet monitoring is a crucial part in threat analysis and often neglected due to the lack of proper open source tools. Our tool will provide an open…

A Wordpress Honeypot

Honeynet Project generic authenticated datafeed protocol

My attempt to make honeypot for React2Shell vulnerability (CVE-2025-66478)

Tools for investigating Log4j CVE-2021-44228

Automated threat intelligence aggregation tool that extracts and normalizes indicators from multiple sources (OSINT feeds, malware reports) into a…

Generates efficient IPv4 blocklists from Zeek network flows using multiple prioritization models (new, consistent, random forest) to identify…