Flamingo is a Go-based credential capture honeypot that listens on multiple network protocols (SSH, HTTP, LDAP, DNS, FTP, SNMP) to intercept authentication attempts from automated scanners, malware, and misconfigured devices. It presents fake service banners and responds to authentication challenges, logging credentials (passwords, NTLM hashes, SSH keys, SNMP community strings) to configurable outputs including stdout, files, webhooks, and syslog. The architecture uses a concurrent record writer pattern: each protocol handler runs as a goroutine, capturing credentials into a buffered channel that feeds multiple output sinks. The code is well-structured with clean separation of protocol handlers, configuration via Cobra CLI flags, and self-signed TLS certificate generation. While the core credential capture logic is tightly coupled to the specific challenge values (e.g., hardcoded NTLM challenge), the output dispatching and port parsing components are extractable. The repository includes vendored LDAP server and ASN.1 BER libraries with modifications.