SuckerPotFeatures
Everything it does, and what it never does.
SuckerPot is a decoy server for a spare machine. It records what bots try, explains it in plain words and helps you report the servers behind them.
What is inside
Bait, a clear view, and a safe way to report.
Sensors
Twelve fake services
They look like SSH, web apps, databases and more. They record every attempt and run nothing.
Dashboard
Attacks in plain words
A live map, one sentence per attack and terminal replays. Click anything to see what is behind it.
Anonymity
Reports that do not name you
Everything leaves through a VPN with a kill switch, and an identity check blocks what could point back to you.
Network
Many honeypots, one report
Opt in, and a bad host is reported once with stronger evidence. Takedowns are tracked.
Blocklist
Free lists for your firewall
Built only from what many sensors agree on. Signed, and entries expire.
At a glance
The short version.
- Twelve fake services, six on by default.
--sensors allturns on all twelve. - One command to install:
./scripts/install.sh, on Docker 24 or newer with the Compose plugin. - Two modes: full, with the dashboard, or participant, which only feeds the network.
- Reports are drafts you read first. By default nothing is sent for you.
- Free, MIT licence, no paid edition.
Built for hostile traffic
It is meant to be attacked, not to fight back.
- The fake services never execute anything an attacker sends.
- Containers run as non-root and read-only.
- Internal networks have no route out.
- No counter-scans and no exploits: it never hacks back.
Get started
Three steps. One machine you can lose.
A spare VM or a cheap VPS is enough. Keep nothing on it that matters: it is meant to be attacked.