I would like to ask for some tips and your own experience. I want to try build some low-interactive honeypot, but I don't know how many services should I run on it or what is suitable to have on this server.

It is better to have only few services or it is better to have as much services as possible? I don't want to have a server which will look very suspicious and nobody will try to touch on it.

I found several solutions e.g. T-Pot, which has a lot of services in its default mode. However I didn't found any best-practices for configuration.

My first goal is to collect some IP addresses, that have some malicious intentions.

Does anybody have some experience and could help me?

  • 1
    It will depend on the honeypot's purpose and its location and context. Where will you place it and why do you want it?
    – schroeder
    Commented May 17, 2023 at 10:40
  • We have company which providing some online services. We are struggling with a lot of scanning, and malicious traffic. As I said, my first goal is to collect IP addresses, which will be then on some blacklist or build some own IP QS. We have some range of public IPs, so honeypot will have one of them. Of course it will be cutted off from our real infrastructure.
    – cipisek
    Commented May 17, 2023 at 11:27
  • 2
    Ok, you want an externally-facing honeypot on the edge to collect IPs so that you can block them in the other edge network protections. From that scope, I'd simply provide only as many services as you have exposed externally. Those will be the IPs that could do the most damage. Adding tons of services will only bring more attention from automated bots once they realise that services are "open".
    – schroeder
    Commented May 17, 2023 at 11:33


You must log in to answer this question.

Browse other questions tagged .