HoneyDB Updates

HoneyDB Agent v2

2024-03-21T10:40:06.380Z

Version 2 of the HoneyDB Agent has been released! In this version there are several internal code optimizations, upgrades and bug fixes. Notably there are significant enhancements to the SSH, Telnet, and FTP plugins. In addition, custom configuration support was added for several of the plugins.

For details on plugin configuration see https://honeydb-agent-docs.readthedocs.io/en/latest/plugins/

This version also sets the foundation for many more improvements and expansion of capability. Custom configuration of plugins will continue to expand and improved service emulation is in the works. Keep an eye on subsequent minor releases as there is more to come!

Happy Honeypotting!

New Endpoint for IBM Cloud IP Ranges

2024-02-14T02:55:44.263Z

Adding to the Datacenter helper endpoint, IBM Cloud IP ranges is now available.

See details here https://honeydb.io/threats#datacenter

New API Endpoint for Payload History

2022-11-28T15:12:29.149Z

new endpoint has been added to the HoneyDB Threat Info API. The “Payload History” endpoint provides access to historical payload data going back to 2014. For more details see the introduction write up on this endpoint here https://deception.substack.com/p/honeydb-payload-history. You can also find details in the API docs here https://honeydb.io/threats#payload_history.

New API Endpoint for ASN Stats

2022-08-16T16:01:04.428Z

A new endpoint has been added to the HoneyDB Threat Info API. The “Stats ASN” endpoint provides a list of Autonomous System's (AS) and count of corresponding IP addresses that have interacted with HoneyDB honeypots. For more details visit https://honeydb.io/threats#stats_asn.

Email Sign In Option

2022-03-30T02:13:49.743Z

New users can now register and sign-in with just an email address.

This new option can be found on the login page. Enter your email address and click the sign in button. Next, check your inbox for an email from HoneyDB. Click the link in the email to sign in.

IP Info Helper Endpoints

2021-02-06T18:25:06.204Z

New IP Info endpoints have been added to the HoneyDB Threat Info API. These endpoints help to provide additional threat context of an IP address. Query the endpoints to determine if an IP is:

A bogon IP
A Tor exit node
On one of the supported threat lists

Supported threat lists include SANS IP, CI Army, Emerging Threats Compromised IP, Project Honeypot, and ThreatCrowd. For more details on these helper endpoints, see the documentation here.

IP History

2021-01-25T03:56:00.001Z

A new feature, IP History, has been released on the HoneyDB web site and threat API. IP History provides a timeline summary of activity for a given IP address. HoneyDB’s database contains data on honeypot interactions going back to 2014.

To view the timeline on the HoneyDB web site you must be logged in. When viewing the host page for a given IP address, click the “HISTORY” tab on the page to load the timeline.

To access this data via the API see documentation here.

Agent Release (v1.18.0)

2020-12-31T20:51:00.001Z

A new version of the agent has been released.

Added CouchDB plugin

https://honeydb.io/downloads

Agent Release (v1.17.0)

2020-11-27T11:46:00.001Z

A new version of the agent has been released.

Added tags option to hpfeeds configuration
Added INFO event for malformed requests in HTTP plugin

https://honeydb.io/downloads

Agent Release (v1.16.0)

2020-11-24T08:33:00.001Z

A new version of the agent has been released.

Added option for printing agent logs to standard out
Fixed bug in hpfeeds logger

https://honeydb.io/downloads