Self-host Krawl
v2.4.0Cloud-native web honeypot with AI-generated deception pages
- Stars
- 820
- Port
- 5000 (HTTP server)
ghcr.io/blessedrebus/krawl
What is Krawl?
Krawl is a cloud-native deception server built to spot and stall bad actors, crawlers, and scanners. It spins up convincing fake web apps — admin panels, config files, made-up credentials — to bait and flag suspicious traffic. Highlights: AI-crafted honeypot pages via OpenRouter or OpenAI, infinite spider-trap links, bogus WordPress and phpMyAdmin logins, trap paths in robots.txt, plausible usernames and API keys, canary-token alerts, randomized server headers, and a live dashboard with geo-attack maps, attack-type charts, threat campaigns, and deep IP forensics. Two run modes: Standalone (SQLite, one container, no outside services) for dev and homelabs; Scalable (PostgreSQL + Redis, horizontal scaling) for production. Prometheus metrics and a Grafana dashboard ship out of the box. The dashboard hides behind a secret URL; password-gated sections manage banlists, watchlists, deception pages, and webhooks for Cloudflare and other firewalls.
Should you self-host Krawl?
Krawl scores 55/100 on selfhost.directory (how scoring works) and ranks #31 of 78 in Security. It has 820 GitHub stars.
It shipped 11 stable releases in the past year. The latest, v2.4.0, came out on 11 September 2026. New versions land roughly every 4 weeks.
Setup is moderate: expect some configuration beyond a single command. An official Docker image is available. It is MIT-licensed and written mostly in Python.
Its closest alternative on selfhost.directory is pentagi (83/100, 32 610 stars). It scores higher overall, so compare the two before you pick. See Krawl vs pentagi side by side.
Features
- AI-generated deception pagesRequires API key; disabled by default
- Banlist federation
- Canary token integration
- Cloudflare banlist sync
- Customizable wordlists
- Fake credentials
- Fake login pages
- Firewall export
- Honeypot paths in robots.txt
- IP reputation analysis
- Random error injection
- Random server headers
- Real-time dashboardHidden behind secret path; password-protected panels for admin functions
- Spider trap pages
- Tarpit for AI crawlersDisabled by default
Krawl README
More in Network Security
mCaptchaSelf-hosted, open-source CAPTCHA server where visitors' browsers do SHA256 proof-of-work instead of image puzzles; the Rust backend runs with Postgres and Redis.
meridianMeridian is an open-source CLI that deploys censorship-resistant VLESS+Reality, XHTTP, and Hysteria2 proxy servers on your VPS with automatic hardening.
NetAlertXSelf-hosted, open-source network monitoring tool that discovers devices via ARP, SNMP, Nmap and router imports, then alerts you on every change.
netbirdNetBird is a self-hosted, open-source zero-trust networking platform with WireGuard mesh, centralized access control, SSO/MFA, and posture checks.
netgoatNetGoat is an open-source, self-hosted Go reverse proxy and free Cloudflare alternative with domain routing, WAF rules, rate limiting, TLS/ACME and bot challenges.
nftables blacklistnftables-blacklist is a self-hosted, open-source bash script that downloads IP blacklists and blocks them via nftables on Linux servers with IPv4/IPv6 support.
ntopngSelf-hosted, open-source (GPLv3) network traffic monitor: live flows, top talkers, nDPI layer-7 detection, NetFlow/sFlow collection and a REST API.
openvpnOpenVPN is an open-source, self-hosted VPN daemon for remote access and site-to-site tunnels, offering PKI auth, NAT traversal, TUN/TAP devices, and post-quantum TLS.
OpenZitiOpenZiti is an open-source, self-hosted zero-trust overlay network: identity-based access, dark services with no open ports, tunnelers and SDKs instead of VPN.
opnsenseSelf-hosted, open-source firewall and routing platform on FreeBSD: stateful filtering, VPN, Suricata IPS, multi-WAN failover, all managed from a web GUI.
Outline ServerOutline Server is a self-hosted, open-source Shadowsocks proxy with a REST API for access keys, enabling your own censorship-resistant VPN.
phantom-wgPhantom-WG is a self-hosted, open-source WireGuard VPN platform with multihop routing, IPv6 dual-stack, and crash recovery via SQLite, all in isolated Docker containers.
0 comments