Open-source honeypot · self-hosted
Let the bots attack.
Then report the servers behind them.
Selfhostr runs twelve fake services on a machine you can afford to lose. It records what bots try, tells each attack as a short story, and writes abuse reports to the networks that host attackers, malware and command servers. Anonymously, through a VPN.
- MIT licence
- Docker Compose
- No hacking back
Story
203.0.113.47 tried 37 SSH passwords and got in, ran 3 commands, then tried to download a file from 198.51.100.23.
Abuse report · ready to review
- to
- abuse@hosting.example
- about
- 198.51.100.23, payload host
- identity check
- passed
- route
- VPN tunnel only
How it works
From a password guess to a takedown request.
Every attack takes the same four steps. You read it at step two and act on it at step three.
-
01
Capture
Twelve fake services answer like the real thing. They record every login, command, request and download URL. Attacker input is never executed.
type login_attempt src 203.0.113.47:50122 user root pass P@ssw0rd
-
02
Story
Events become sessions, and each session becomes one plain sentence with tags, a country and a network. Everything in it is a link.
tried 37 SSH passwords and got in, ran 3 commands, then tried to download a file
-
03
Report
Selfhostr finds the abuse contact of each attacker, payload host and C2 server, and drafts a report. An identity check blocks anything that could point back to you.
X-ARF v0.2 to abuse@hosting.example check passed
-
04
Takedown
Selfhostr checks whether reported hosts go offline, so you know which reports worked and which providers ignore them.
198.51.100.23 reported day 0 offline —
Sensors
Twelve doors. All of them fake.
Each service answers with real banners and versions, so bots go further than a port scan. It records what they do and runs none of it.
- Remote shells
- Web and APIs
- Databases
- Windows and VoIP
Payloads
Malware goes to quarantine. Never to a shell.
When a bot tries to download something, the sensor only writes down the URL. A separate collector can then fetch it, through the VPN, with size and time limits.
- Stored under its SHA-256, read-only, never executed.
- Static analysis only: file type, strings, YARA rules, script deobfuscation.
- The command servers it contacts are extracted and can be reported too.
- Off by default. You turn it on.
- sha256
- 4c1f9e0a…d27b5e83
- type
- ELF 32-bit, ARM
- from
- http://198.51.100.23/arm7
- fetched
- through the VPN tunnel
- yara
- mirai_generic (severe)
- c2
- 203.0.113.200:23
- state
- quarantined · mode 0400
Anonymity by design
Your home address never leaves first.
Attackers already know the address they hit. Nothing else should learn it from you. So every outbound connection takes one road, and that road has a gate.
Your machine
- lookups
- payload fetches
- abuse reports
Identity check
Refuses any text that names you, your address, your host or the project.
VPN + kill switch
Tunnel down means nothing leaves. DNS goes through it too.
Internet
Sees the VPN exit, not you.
- Only one container can reach the internet: the VPN client. A test in CI checks this on every change.
- Reports carry facts only: times, addresses, commands, URLs, hashes. Wording is optional.
- You review each report. Send it from your own anonymous mailbox, or let Selfhostr send it through the tunnel.
$ check report-7f3a.eml body 2 URLs, 1 hash ok headers neutral ok line 12 names this host stop refused: nothing was sent
The network
Many honeypots. One report.
One honeypot sees one attack. Twenty see a pattern. The network lets Selfhostr nodes pool what they observe, so a bad host is reported once, with stronger evidence, instead of twenty times with weak evidence.
- Opt-in. A node that does not join sends nothing.
- No account and no email. A node is at most an optional pseudonym.
- Only the facts a report would carry are shared. The hub never stores a node’s address.
- Malware links seen by several nodes go to abuse.ch, after a human review.
Help the network
Three commands. No dashboard. No VPN needed.
Want to help and nothing else? Run the sensors on a spare machine, open the ports the installer prints, and you are in. Choosing this mode is your consent to join.
git clone --depth 1 --branch v0.7.1 https://github.com/Theroxat/suckerpot.git cd suckerpot ./scripts/install.sh --participant
- Sensors, database and the network node only, in about 2 GiB of memory.
- In this mode the machine sends no reports itself.
- Without a VPN, the hub and the tunnel provider in front of it see your home address. The hub never stores it. Add a VPN any time.
- Signed releases install themselves once a day, at least 48 hours after they are published. One command turns it off.
- Leave any time with ./scripts/participant.sh leave.
Install
Three steps. One machine you can lose.
A small VM or a cheap VPS is enough. Keep nothing on it that matters: it is meant to be attacked. Just want to help the network, without a dashboard? Three commands.
-
01
Get the code
You need Linux and Docker 24 or newer with the Compose plugin.
git clone --depth 1 --branch v0.7.1 https://github.com/Theroxat/suckerpot.git cd suckerpot
-
02
Run the installer
It checks the machine, asks a few questions and generates every secret on this host. A VPN and API keys are optional. By default the recommended sensors are on (6); --sensors all turns on all twelve.
./scripts/install.sh
-
03
Open the dashboard
Open the address the installer prints and follow the setup checklist before you open any port. Check the stack any time:
./scripts/status.sh
FAQ
Straight answers.
What people ask before they put a honeypot on the internet.
Does it hack back?
No, never. No counter-scans, no exploits, no attacks of any kind. Selfhostr records what is sent to it, analyses files without running them, and writes reports to the people whose job is to act on them.
Is it legal?
In most places you may record traffic that strangers send to your own machine, and reporting abuse to a hosting provider is what abuse contacts exist for. Laws and hosting terms differ, so check yours, especially before you turn on payload collection.
Is it safe to run?
It is built for hostile traffic: the fake services emulate and never execute, containers run as non-root and read-only with every capability dropped, and the internal networks have no route out. Still, run it on a machine or VM that you can afford to lose, and keep nothing else on it.
Can a report point back to me?
Reports leave only through the VPN, and the identity check refuses any text that names you, your address, your host names or the project. One limit remains: a report carries times and ports, and the attacker's network could match them with its own logs to find the address that was attacked. The attacker already knew it.
Do I need a VPN?
Only for the features that go out: lookups, payload fetches and sending reports. Without a WireGuard configuration they stay closed, and the honeypot still records and tells every attack.
What does it cost?
Nothing. Selfhostr is open source under the MIT licence. Reputation lookups use free tiers, and every API key is optional.