dataforgecanada/honeypot repository overview

⁠Dataforge Honeypot — edge detector

hpot-detector is the decoy-side agent for Dataforge Honeypot⁠: a honeypot platform for detecting probe and lateral-movement traffic on decoy VMs and appliances.

This container runs fake TCP and UDP services, optionally captures port-scan traffic with a packet sniffer, buffers events locally, and uploads them to the Dataforge-hosted director. Configuration is pulled from the director on every container start — no manual config file to bake into the image.

The director is operated by Dataforge only. To use this image, create an account, register a decoy device in the portal, and use the generated deploy command.

Create an account⁠

⁠Features

• SMTP and SSH decoy handlers (TCP) with realistic banners and session capture
• Generic TCP/UDP handlers for custom ports and protocols
• Optional Scapy sniffer for sub-handler port activity (TCP + UDP)
• Local SQLite buffer with batch upload and keepalive to the director
• Portal-driven config — change settings in the web UI; detectors reload automatically
• Abuse and flood protection to stay stable under heavy scanning

⁠Requirements

• A Dataforge Honeypot account (sign up⁠)
• A device ID and API key from the portal (after you add a decoy)
• Outbound HTTPS from the decoy host to https://honeypot.app.dataforgecanada.com

⁠Quick start

1. Sign up⁠ and sign in to the portal.
2. Add a decoy device, configure it, and click Generate run command on the Deploy page.
3. On your decoy VM, run the command from the portal (it includes docker pull, env vars, and the pinned tag).

Example shape (use the portal command for your device — it includes your API key and the active release tag):

docker pull dataforgecanada/honeypot:latest

docker run -d --name hpot-detector --restart unless-stopped \
  --network host \
  --cap-add NET_RAW \
  --cap-add NET_ADMIN \
  -e HPOT_DIRECTOR_URL="https://honeypot.app.dataforgecanada.com" \
  -e HPOT_DEVICE_ID="your-device-uuid" \
  -e HPOT_API_KEY="your-api-key" \
  -v hpot-detector-data:/app/data \
  dataforgecanada/honeypot:latest