Honeypot
What is Honeypot?
A honeypot is a deliberately exposed decoy system set up to attract scanning and attack traffic so defenders can observe attacker behavior without risking any real system or data. AdminKit's protective DNS product uses this kind of sensor data, gathered by honeypot and sensor networks, to inform its blocklists.
By AdminKit team, Netbase JSC · Updated
A honeypot is a deliberately exposed decoy system — a fake server, service, or device — set up to attract scanning and attack traffic so defenders can observe attacker behavior, techniques, and targets without putting any real system or data at risk. Because a honeypot has no legitimate business purpose, essentially all traffic that reaches it is unsolicited scanning, probing, or attack activity, which makes honeypot data useful for understanding what’s actively being targeted on the internet right now — which ports, which protocols, which known exploits — rather than relying on theoretical risk alone. Honeypot and sensor networks are a common way security researchers and vendors gather real-world threat intelligence. A honeypot mimicking an exposed remote-desktop service like VNC, or a plaintext legacy service like Telnet, can show exactly which scanners and credential-stuffing tools come looking for an open, poorly authenticated session. The IETF’s Internet Security Glossary, RFC 4949, defines a honey pot as a system or system resource designed to be attractive to potential crackers and intruders. The Honeynet Project pioneered much of this research, and NIST SP 800-115, the federal technical guide to security testing, covers honeypots as a detection method. AdminKit’s protective DNS product draws on this kind of sensor data to help inform its blocklists.
AdminKit groups honeypot under its machine protocols cluster — browse the AdminKit glossary index for other related terms.
Frequently asked questions
Is a honeypot the same as a firewall or an IDS?
No -- a firewall blocks traffic and an IDS watches real systems for suspicious activity, while a honeypot is a decoy system with no legitimate purpose, so any traffic reaching it is itself the signal, not something to be filtered for false positives.
Does running a honeypot protect the system it's decoying for?
Not directly -- a honeypot's value is in observing attacker behavior and generating threat intelligence, not in deflecting attacks away from real systems, though the data it produces can inform defenses elsewhere.
What kind of data does a honeypot produce?
Logs of scanning, probing, and exploit attempts against the decoy -- which ports and protocols are targeted and which known exploits are attempted -- showing what's actively being targeted on the internet right now rather than relying on theoretical risk alone.
Who uses honeypot data in practice?
Security researchers and vendors commonly run honeypot and sensor networks to gather real-world threat intelligence; AdminKit's protective DNS product uses this kind of sensor data to help inform its blocklists.