SentryPeer
A peer-to-peer SIP honeypot and fraud detection tool that collects and shares malicious IP addresses and phone numbers.
What is SentryPeer?
SentryPeer is a fraud detection tool that acts as a SIP honeypot to collect malicious IP addresses and phone numbers from attackers probing VoIP systems. It enables users to share this data via a peer-to-peer network, providing a decentralized threat intelligence platform for SIP server protection. The tool helps prevent voicemail fraud, credential theft, and expensive call scams by alerting administrators to known bad actors.
VoIP administrators, telecom service providers, and security professionals running SIP servers (e.g., PBX systems like FreeSWITCH, Asterisk) who need to detect and block fraudulent activity. It is also suitable for honeypot enthusiasts and those interested in decentralized security data sharing.
Developers choose SentryPeer because it offers a decentralized, user-owned alternative to centralized fraud detection services, ensuring data privacy and control. Its peer-to-peer sharing model, combined with local storage and a rich API, provides real-time threat intelligence without vendor lock-in.
Overview
Protect your SIP Servers from bad actors at https://sentrypeer.org
Use Cases
Best For
- Protecting on-premise VoIP PBX systems from SIP scanning and fraud
- Building a decentralized threat intelligence network for telecom providers
- Integrating fraud detection with existing monitoring systems via REST API
- Deploying a lightweight honeypot for IoT or embedded VoIP devices
- Automating IP blocking with Fail2ban using syslog output
- Self-hosting a fraud detection service to retain data ownership
Not Ideal For
- Enterprises needing a fully managed, SaaS-based fraud detection service with minimal configuration and vendor support.
- Projects focused on monitoring non-SIP telephony protocols like WebRTC, H.323, or traditional PSTN systems.
- Teams without dedicated VoIP or network security expertise to handle the complex setup and ongoing maintenance of a peer-to-peer node.
Pros & Cons
Pros
Uses OpenDHT for opt-in peer-to-peer sharing, allowing users to control and own their collected data while benefiting from community intelligence, as emphasized in the philosophy section.
Stores events in a local SQLite database or JSON logs with a RESTful API for quick queries, enabling real-time integration with PBX/ITSP systems to check for known bad actors.
Supports WebHook integration (including SentryPeerHQ), Fail2ban via syslog output, and Docker deployment, making it adaptable to various monitoring and blocking workflows.
Handles UDP, TCP, and TLS for SIP communication, ensuring compatibility with different network configurations and security needs, as listed in the features.
Cons
The README marks key features like IPSET API and BGP agent for blackholing as TODO items, limiting advanced, automated firewall integration without custom development.
Building from source requires installing numerous libraries (e.g., libosip2, libsqlite3, OpenDHT, Rust) across different platforms, which can be error-prone and time-consuming.
Focused solely on SIP fraud detection via honeypot responses, so it's ineffective for broader network security or non-VoIP threat monitoring without significant adaptation.
Frequently Asked Questions
Related Projects
T-Pot🍯 T-Pot - The All In One Multi Honeypot Platform 🐝
EndlesshSSH tarpit that slowly sends an endless banner
CowrieCowrie SSH/Telnet Honeypot https://docs.cowrie.org/
AndroguardReverse engineering and pentesting for Android applications
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.