msfire/honeypot repository overview

⁠🍯 Python Low-Interaction Honeypot

A lightweight, low-interaction honeypot designed to emulate vulnerable Telnet and FTP services. Built as a Cyber Security academic project, this container captures connection attempts and analyzes behavioral patterns.

⁠🚀 Features

• Dual Service Emulation: Simulates Telnet (port 23) and FTP (port 21) daemons.
• Smart Threat Intelligence: Integrated with vpnapi.io⁠ to detect if the attacker is using a VPN, Tor node, or Proxy.
• Behavioral Profiling: Distinguishes between automated Bots and human attackers based on keystroke latency (typing speed analysis).
• Secure Architecture: Runs as a non-root user inside the container for better security.
• Logging: Detailed logs including timestamps, IP origin, commands attempted, and threat intelligence data.

⁠🛠 Quick Start

⁠1. Basic Run

To run the honeypot exposing Telnet on port 23 (mapped to internal port 2323):

docker run -d \
  -p 23:2323 \
  --name honeypot \
  msfire/honeypot:latest