How to set up HellPot behind nginx to trap bots?

Use the provided nginx configuration snippet in the README to proxy specific paths like /wp-login.php to HellPot's localhost port, ensuring the X-Real-IP header is passed for accurate logging.

HellPot vs Heffalump: which is better for honeypots?

HellPot is a fork of Heffalump with performance enhancements using fasthttp and added TOML configurability, making it more suitable for high-traffic environments, though both serve infinite streams to waste bot resources.

Does HellPot slow down my web server?

It can consume resources when actively serving infinite streams to bots, but its fasthttp engine is optimized for efficiency; monitor performance and adjust concurrency settings in the TOML config if needed.

Can I customize the deceptive content in HellPot?

No, the content is fixed to a Markov chain based on Nietzsche's text; to change it, you'd need to modify the Go source code and rebuild the binary, which requires programming knowledge.

What happens if a real user accidentally accesses HellPot?

If misconfigured, legitimate users might hit the infinite stream; integrate carefully using path-based routing (e.g., only for /wp-login.php) and test with reverse proxies to avoid affecting normal traffic.

Is HellPot legal to use against bots?

Generally yes, as it targets malicious bots ignoring robots.txt, but consult local laws on deception and resource consumption; it's designed for self-defense on your own servers.

Open-Awesome

HellPot

MITGov0.5.4+build2

A high-performance HTTP honeypot that punishes unruly bots by serving them an infinite stream of deceptive content.

GitHub

1.1k stars52 forks0 contributors

What is HellPot?

HellPot is a cross-platform HTTP honeypot that punishes unruly bots by serving them an infinite stream of deceptive content. It traps bots that ignore `robots.txt` and probe web servers, wasting their resources with a Markov engine that generates realistic-looking responses. The tool is designed for high performance and easy integration via reverse proxies.

Target Audience

System administrators, DevOps engineers, and security professionals looking to deploy a lightweight, self-hosted honeypot to deter and analyze malicious bot traffic on their web servers.

Value Proposition

Developers choose HellPot for its unique approach of actively punishing bots with endless content, its high performance due to fasthttp, and its easy configurability via TOML and environment variables, making it a practical addition to existing web server setups.

Overview

HellPot is a cross-platform portal to endless suffering meant to punish unruly HTTP bots.

Use Cases

Best For

Trapping bots that scan for vulnerabilities like wp-login.php
Wasting resources of malicious crawlers that ignore robots.txt
Adding a deceptive layer to web server security behind nginx or Apache
Logging bot interactions with structured JSON for analysis
Deploying a lightweight, self-hosted honeypot on Go-based infrastructure
Punishing automated scanners with infinite, realistic-looking responses

Not Ideal For

Projects needing immediate blocking or rate-limiting of malicious traffic without engaging bots
Environments with strict resource constraints where serving infinite streams is unsustainable
Security teams requiring advanced bot analysis or forensic data beyond basic JSON logging
Compliance-sensitive setups that must avoid any risk of deceiving legitimate users or handling sensitive data

Pros & Cons

Pros

High Performance Engine

Utilizes fasthttp for efficient HTTP handling with configurable concurrency controls, allowing it to handle high volumes of bot traffic without significant overhead.

Flexible Configuration

Supports TOML configuration files with environment variable overrides, making deployment and customization easy across different server environments.

Reverse Proxy Ready

Includes example configurations for nginx and Apache, simplifying integration behind existing web servers to trap bots on specific paths.

Structured Logging

Integrates zerolog for JSON-formatted logs stored in a configurable directory, providing clear, machine-readable data on bot interactions.

Cons

Resource Intensive Operation

Serving an infinite stream of data can consume significant server bandwidth and CPU, potentially impacting performance under sustained bot attacks.

Limited Content Customization

The Markov engine is based solely on Nietzsche's text, offering no built-in way to mimic other website content without modifying the source code.

No Native SSL Support

Requires a reverse proxy for HTTPS handling, adding complexity for deployments needing direct SSL/TLS termination or encrypted connections.

Frequently Asked Questions

Related Projects

T-Pot

🍯 T-Pot - The All In One Multi Honeypot Platform 🐝

Stars9,114

Forks1,347

Last commit1 month ago

Endlessh

SSH tarpit that slowly sends an endless banner

Stars8,447

Forks306

Last commit1 year ago

Androguard

Reverse engineering and pentesting for Android applications

Stars6,052

Forks1,139

Last commit3 months ago

OpenCanary

Modular and decentralised honeypot

Stars2,854

Forks398

Last commit3 days ago

Community-curated · Updated weekly · 100% open source

Found a gem we're missing?

Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.

Submit a project Star on GitHub