Self-host deceptifeed
v0.69.0Honeypot server with integrated threat feed
- Stars
- 140
- Ports
- 2222 (SSH honeypot), 8080 (HTTP honeypot), 8443 (HTTPS honeypot), 9000 (Threat feed HTTP server)
deceptifeed/server:latest
What is deceptifeed?
This tool operates multiple low-interaction honeypots — SSH, HTTP/HTTPS, TCP, and UDP — that capture attacker activity without granting real access. It publishes a threat feed of offending IPs in several formats plus a web UI for browsing the data. Structured JSON logs support SIEM forwarding with automatic rollover. The single binary has zero external dependencies and runs on Linux, macOS, Windows, and BSD. Deployment options include a standalone binary, Docker container, or a systemd install script for Linux servers.
Should you self-host deceptifeed?
deceptifeed scores 43/100 on selfhost.directory (how scoring works) and ranks #59 of 78 in Security. It has 140 GitHub stars.
It shipped 5 stable releases in the past year. The latest, v0.69.0, came out on 14 July 2026. New versions land roughly every 2 weeks.
Setup is moderate: expect some configuration beyond a single command. An official Docker image is available. It is MIT-licensed and written mostly in Go.
Its closest alternative on selfhost.directory is pentagi (83/100, 32 639 stars). It scores higher overall, so compare the two before you pick. See deceptifeed vs pentagi side by side.
Features
- Cross-platform
- HTTP/HTTPS honeypot
- No external dependencies
- SSH honeypot
- Structured JSON logging
- TCP honeypot
- Threat Feed
- UDP honeypot
- Web Interface
deceptifeed README
More in Network Monitoring
dishDish is a self-hosted, open-source monitoring tool for one-shot HTTP, ICMP, and TCP health checks with remote config and multi-channel alerting.
docker-external-ipSelf-hosted Docker container that checks external IP via DIG/curl and sends Pushover or Apprise notifications on change.
docker-fr24feed-piaware-dump1090Self-hosted Docker image running dump1090-fa, FR24feed, piaware, and feeders for ADS-B Exchange, Plane Finder, OpenSky, adsb.fi, Radarbox, ADSBHub with RTL-SDR.
docsightSelf-hosted open-source app that captures DOCSIS signals, speed tests, and latency to document cable internet issues and prove them to your ISP.
DStatusSelf-hosted server monitoring & AI ops panel: real-time metrics, 3-network TCPing, MTR, IP/streaming checks, alerts, WebSSH, renewals, AI assistant. Free: 3 nodes.
EdMonEdMon is a self-hosted Java tool that monitors servers via ICMP ping and services via TCP, sending notifications through HTTP webhooks with master/secondary failover.
Fail2Ban-ReportSelf-hosted web dashboard aggregating Fail2Ban logs from multiple servers into searchable JSON reports with UFW blocklist sync and role-based auth.
Fail2NetworkBanFail2NetworkBan is a self-hosted, open-source Python client/server that sends Fail2Ban bans to Proxmox for network-wide IP blocking across all VMs.
globalping-probeSelf-hosted network probe that joins the Globalping community network to run ping, traceroute, DNS, and HTTP tests from your location.
gonzalesGonzales is a self-hosted, open-source internet speed monitor running automated 24/7 Ookla tests with a real-time dashboard, Home Assistant integration, and ISP grading.
GPONSelf-hosted Prometheus exporter scraping ~75 metrics from Realtek RTL960x GPON SFP ONUs over SSH, with pre-built Grafana dashboard.
heplifyheplify is a self-hosted, open-source HEP capture agent for SIP, RTCP, DNS, Diameter and logs. Runs as a single binary on Linux, macOS, Windows with Docker.
0 comments