A modern SMTP honeypot that simulates a vulnerable mail server to capture and log email-based attacks with database integration.
Mailoney is an SMTP honeypot that simulates a vulnerable mail server to capture and log email-based attacks. It detects unauthorized access attempts, credential harvesting, and other SMTP-based threats, storing all interaction data in a database for analysis. The project provides a controlled environment to monitor malicious activity and gather intelligence on email security threats.
Security researchers, system administrators, and cybersecurity teams who need to monitor and analyze email-based attack vectors in their networks.
Developers choose Mailoney for its modern, containerized deployment, structured database logging, and ease of integration into existing security workflows. It offers a production-ready, low-interaction honeypot with maintainable code and flexible configuration options.
An SMTP Honeypot
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
The Docker Compose setup allows one-command deployment with PostgreSQL persistence, making it production-ready and easy to scale, as highlighted in the recommended installation option.
It captures all SMTP sessions and credentials in a database with a clear schema, enabling straightforward analysis and integration, evidenced by the detailed database tables for sessions and credentials.
Built with Python best practices, including database migrations and a clean project structure, which simplifies customization and updates, as shown in the development section with Alembic migrations.
Supports multiple database backends (SQLite, PostgreSQL, MySQL) and environment-based settings, allowing adaptation to various infrastructures without code changes.
As a low-interaction honeypot, it only simulates basic SMTP responses and doesn't adapt to complex attack patterns, which might reduce effectiveness against sophisticated threats.
Requires a running database instance like PostgreSQL for production use, adding setup and maintenance complexity compared to log-file-only alternatives.
Lacks built-in APIs or connectors for security tools; the README admits that integrating with SIEM systems needs separate services or extension development.