Attack Traps
The honeypot simulates 90+ real attack surfaces that are actively scanned on the public internet every day. Each trap responds with convincing fake data — the same response format a real vulnerable server would return — to keep scanners engaged and wasting time.
Every matched trap sets an attack_tag in the JSON log and webhook payload, letting you route and analyse by attack type.
Trap categories
| Category | Page | Tags |
|---|---|---|
| Spring Boot Actuator | Spring Boot | spring-actuator-* |
| WordPress & CMS | CMS | wp-login, xmlrpc, joomla-admin, … |
| Microsoft Exchange | Exchange | owa-login, exchange-ews, exchange-proxylogon |
| Edge Appliances & VPN | VPN | fortinet-fgt, sonicwall-vpn, pulse-secure, cisco-asa-vpn, citrix-netscaler-*, panos-globalprotect-*, loadmaster-api |
| AI Agents & MCP | AI Agents & MCP | mcp-server-probe, ai-assistant-config, ai-assistant-credentials, llm-openai-models, ollama-tags, ssrf-metadata-probe |
| Kubernetes & Docker | Kubernetes & Docker | k8s-pods, k8s-secrets, docker-api |
| Cloud Metadata | Cloud Metadata | aws-metadata, gcp-metadata, do-metadata |
| Credential & File Leaks | Credential Leaks | env-file, env-file-variant, git-config, git-credentials, password-store-leak, registry-token-leak, aws-credentials, ssh-key, vite-file-read, … |
| REST API IDOR | REST API | rest-api-idor-users, rest-api-idor-accounts, … |
| SharePoint, ColdFusion, Langflow, Metabase, N-central, vCenter & co. | Other Services | sharepoint-toolpane, coldfusion-admin, langflow-apikey, metabase-sqli, nable-ncentral-auth, vmware-vcenter-session, apache-solr, jenkins-script, h2-console, grafana, … |
| Log4Shell | Log4Shell | log4shell |