SuckerPot
SuckerPot is a self-hosted honeypot with a dashboard that makes internet attacks easy to read. A few fake services (sensors) take the attacks. Each attack becomes an event. The events are enriched, tagged and stored. One dashboard shows what happened, as a story you can follow.
SuckerPot is made by Selfhostr, a small organisation that builds self-hosted tools. Technical names (packages, volumes, environment variables) use the suckerpot prefix.
Everything runs in Docker Compose on one host.
Status: v0.2.0. Twelve sensors, enrichment and tagging, and a dashboard organised in three spaces (Observe, Understand, Defend) plus Settings. The new analysis features are off until you turn them on. See the roadmap.
User guide
- Getting started
- Install SuckerPot
- Join the network in three commands
- Updates and rollback
- Deployment
- Demo data
- Dashboard
- Defend: blocklists, detection rules and your exposure
- Replies to reports
- Takedowns
- The SuckerPot network
- Community blocklist feeds
- Provider API keys
Sensors
Reference
- Architecture
- Configuration
- Event schema
- API
- Data retention
- Network protocol spn/1
- Security
- M21 design: anonymous egress, payload collection and static analysis
- M22 design: anonymous abuse reporting
- M23 — Upload the VPN configuration from the dashboard
- M24 — Guided tour, setup checklist and tunnel controls
- M25 — Sending abuse reports: a send queue, and optional SMTP
- M26 — Report outcomes: did anyone answer?
- M27 — Takedown tracking and abuse.ch submission
- M28 — Installable by anyone
- M29 — The SuckerPot network (opt-in, anonymous)
- M30 — Community blocklist feeds
- M32 — Join the network in three commands
- M33: the network is on by default
Project