A Python telnet honeypot that emulates a shell environment to catch IoT botnet binaries and analyze malware networks.
Telnet IoT honeypot is a Python telnet server that acts as a honeypot to catch IoT malware binaries spreading through insecure default telnet passwords. It emulates a shell environment to interact with botnet connections and automatically analyzes them to map and link different botnet networks. The project helps researchers track and understand IoT malware campaigns by collecting and correlating connection data.
Security researchers, malware analysts, and network administrators interested in studying IoT botnets, capturing malware samples, and analyzing botnet infrastructure.
It provides an automated, client-server based honeypot specifically designed for IoT malware, with built-in analysis to link connections and identify malware families, offering insights into botnet behaviors without complex setup.
Python telnet honeypot for catching botnet binaries
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Links connections into networks based on shared credentials or IP addresses within minutes, automatically correlating IoT malware campaigns as described in the automatic analysis section.
Supports multiple honeypot clients reporting to a central backend, enabling distributed data collection and centralized analysis per the architecture overview.
Uses a custom hashing function to compare session texts across networks, helping identify similar malware strains based on command patterns without manual inspection.
Provides an HTTP frontend for accessing analysis results and managing the system, making it easier to visualize and interact with collected data as shown in the screenshots.
Built on Python2, which reached end-of-life in 2020, leading to dependency installation challenges and lack of security updates, as explicitly warned in the disclaimer.
No longer supported or in development, meaning bugs won't be fixed and features won't be updated, posing a risk for long-term research or deployment.
Specifically designed for telnet-only honeypotting, so it cannot capture attacks over other common IoT protocols like SSH without using external tools like Cowrie with a plugin.
Requires configuration of SQL databases, user accounts, and multiple YAML files, which can be cumbersome compared to simpler, plug-and-play honeypot solutions.