T-Pot Community Edition (tpotce) is an all-in-one honeypot platform that orchestrates 20+ honeypots (e.g., cowrie, dionaea, conpot, heralding) alongside network security monitoring tools (p0f, Suricata, fatt) and the Elastic Stack (Elasticsearch, Logstash, Kibana) for centralized log storage, analysis, and real-time attack visualization. The system is deployed via Docker Compose with an Ansible-based installer supporting multiple Linux distributions. It offers several deployment flavors (standard, sensor, mini, LLM, tarpit, mobile) and supports a distributed Hive/Sensor architecture where remote sensors forward encrypted logs to a central Hive over HTTPS. Architecturally, each honeypot runs in an isolated container with read-only filesystems, non-root user, and dedicated networks. The ELK stack processes all telemetry: Logstash ingests JSON logs from persistent volumes, Elasticsearch indexes them, and Kibana provides dashboards and an attack map. A custom p0f (passive OS fingerprinting) fork is bundled and compiled from C source, demonstrating deep network-level analysis. The update and backup system (`update.sh`) is a robust, self-contained script that handles version pinning, configuration backups, Elasticsearch state exports, and image rollouts. The codebase includes a reusable test harness (`docker/_tests/lib/common.sh`) for validating individual honeypot containers with protocol-specific probes.
GreedyBear is a threat intelligence platform that consumes honeypot logs from T-Pot clusters (Cowrie, Heralding, Tanner, etc.), extracts Indicators of Compromise (IOCs), enriches them with external threat feeds (ThreatFox, AbuseIPDB, FireHol, Spamhaus, MalwareBazaar), and applies machine learning scoring (Random Forest) to predict recurrence probability and expected interactions. The system exposes public and authenticated APIs in multiple formats (JSON, NDJSON, CSV, TXT, STIX 2.1) for threat researchers and supports event ingestion from external sensors. The backend is built with Django/DRF, PostgreSQL, and Elasticsearch, orchestrated via Django-Q cronjobs for scheduled extraction, enrichment, and cleanup. A React SPA frontend provides a customizable dashboard with attack maps, trending attackers, and feed browsing. The architecture uses repository, strategy, and factory patterns, with a clean separation between extraction pipelines, scoring, and API layers. While primarily an application, it has strong data engineering components—ETL pipelines, ML scoring, clustering (MinHash LSH for command sequences), and data enrichment—making it a hybrid that leans application.
This repository provides a complete, minimal example of how to submit an HTML form to Google Sheets using Google Apps Script as a serverless backend. The core is a Google Apps Script (form-script.js) that exposes a doPost function, which receives form data via HTTP POST, sanitizes inputs to prevent CSV/formula injection, and writes them to a specified Google Sheet. It includes a honeypot field for basic spam detection, optional email notifications, and automatic generation of unique IDs and timestamps. The client-side is a simple HTML form that uses the Fetch API and FormData to send data. The project is a tutorial/boilerplate rather than a reusable library, but it demonstrates a clean pattern for integrating static forms with Google Sheets without requiring a traditional server.
This is a configuration-only infrastructure repository: it extends fail2ban so that a banned IP is not simply blocked, but has its SSH traffic redirected to a local endlessh tarpit on port 2222. The repository ships two fail2ban action definitions and one jail snippet. The iptables action inserts a NAT PREROUTING REDIRECT rule for the banned source IP on port 22; the firewalld action uses firewall-cmd rich rules with forward-port to the same effect. A jail.d config attaches the default endlessh action to the sshd jail. There is no application code, test suite, build system, or packaging; the artifact is three drop-in configuration files meant to be copied into /etc/fail2ban. This makes the project extremely simple and dependency-light, relying only on fail2ban and either iptables or firewalld. The core idea is clever and portable: instead of dropping malicious traffic, the system wastes an attacker's time against a tarpit. The two firewall backends give useful coverage across common Linux distributions. As a codebase it is minimal, and the craftsmanship lies in the choice of firewall rules rather than in software architecture. The files are clean, follow fail2ban's action and jail conventions, and are directly reusable by anyone already running endlessh on port 2222.
The provided repository contains only the documentation website for the HFish honeypot platform (a Go-based B/S architecture application). No actual application source code (Go, JavaScript, etc.) is present in the file tree. The documentation is extensive, covering deployment, usage, and advanced features, but the core application logic cannot be evaluated. The repo appears to be actively maintained with a large community, but the absence of code prevents any assessment of architecture, data flows, or reusable components.