# deceptifeed

> Self-hosted honeypot server running SSH, HTTP, TCP, UDP services with threat feed in multiple formats for firewall integration.

- **Category:** Security
- **Licence:** MIT
- **Latest version:** v0.69.0
- **Open source:** oss
- **Languages:** Go, HTML
- **Platforms:** Docker, Linux
- **Tags:** Honeypot, Network Security, Intrusion Detection, Threat intelligence, Stix, Firewall integration, Honeypots, Detect, Defend, Threat Feed, SSH Honeypot, HTTP Honeypot, Taxii

## Description

This tool operates multiple low-interaction honeypots — SSH, HTTP/HTTPS, TCP, and UDP — that capture attacker activity without granting real access. It publishes a threat feed of offending IPs in several formats plus a web UI for browsing the data. Structured JSON logs support SIEM forwarding with automatic rollover. The single binary has zero external dependencies and runs on Linux, macOS, Windows, and BSD. Deployment options include a standalone binary, Docker container, or a systemd install script for Linux servers.

## Links

- [Homepage](https://github.com/r-smith/deceptifeed)
- [Docker](deceptifeed/server:latest)
- [GitHub Repository](https://github.com/r-smith/deceptifeed)
- [Releases](https://github.com/r-smith/deceptifeed/releases)
- [Docker Config](https://raw.githubusercontent.com/r-smith/deceptifeed/main/configs/docker-config.xml)

---
Source: https://selfhost.directory/project/deceptifeed