# Knock-Knock

> A self-hosted honeypot that captures live bot attacks across many protocols with a real-time dashboard and threat intel feeds.

- **Category:** Security
- **Licence:** MIT
- **Latest version:** v3.0.0
- **Open source:** oss
- **Languages:** Python, HTML
- **Platforms:** Docker Compose, Linux, Debian
- **Tags:** Dashboard, Security, SMTP, Extensible, Sip, Telnet, Mqtt, HTTP, Ftp, Modbus, Node Red, Rdp, Cybersecurity, Honeypot, Ssh, Docker, Python, Smb, Geoip, Self Hosted, Threat intelligence, Bots, Blocklist, Visualizations

## Description

This project is a honeypot platform that simulates vulnerable network services to attract and study automated attack traffic. It emulates common protocols like SSH, FTP, remote desktop, mail, and voice services, then presents the captured intrusion attempts in a browser-based dashboard with live maps, ranked lists of usernames and passwords, and geographic breakdowns. The system uses MaxMind geolocation to enrich each connection attempt, stores data in SQLite with Redis for real-time updates, and exposes a FastAPI web interface. It can aggregate feeds from multiple sensors into one view and publishes a blocklist of offending addresses that works with popular firewall tools. Deployment options include containerized setups with Docker Compose or traditional service units on major Linux distributions. A server with a public address and root privileges is needed, and the real SSH daemon must be relocated off the standard port.

## Links

- [Homepage](https://github.com/djkurlander/knock-knock)
- [Website](https://knock-knock.net)
- [Docker](ghcr.io/djkurlander/knock-knock)
- [Demo](https://knock-knock.net)
- [GitHub Repository](https://github.com/djkurlander/knock-knock)
- [Live Tutorial](https://knock-knock.net/summary)
- [IP Blocklist Feed](https://knock-knock.net/blocklist)
- [API Documentation](https://knock-knock.net/api)

---
Source: https://selfhost.directory/project/knock-knock