Bots that knock on your server's login ports are always turned away by Knock-Knock, a multi-protocol honeypot that shows every attempt on a live dashboard. Honeypots answer on the standard ports for SSH, Telnet, FTP, RDP, SMB, SIP, HTTP, and SMTP, with MQTT, Node-RED, Modbus, S7, and SNMP as optional extras. Authentication is always rejected, so no bot ever gets a shell. Who is knocking? The live feed shows each attempt's country, username, password, ISP, IP, and protocol. From where? A 3D globe marks the origin in one of six styles, including an extruded country heat map. Trying what? Leaderboards rank countries, usernames, passwords, ISPs, and IP addresses, and a trivia panel explains why bots favor certain credentials. A protocol filter re-slices the feed, globe, and leaderboards together; SIP shows dialed numbers and toll-call destinations, and RDP shows hostnames and accounts. Too fast? Press the space bar to pause, right-click any knock for details, or switch on a virtual Geiger counter that clicks as attacks arrive. Want to fight back? Download hourly 30-day and 365-day blocklists with recipes for CSF, CrowdSec, ipset, nftables, and pfSense, or query the optional API for any IP, CIDR range, or ASN. Several honeypot servers can stream into one aggregated dashboard. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Leave a fake door unlocked and see who walks through: Krawl is a self-hosted honeypot that poses as a sloppy web server and records everything scanners and scrapers try. Fake WordPress, phpMyAdmin, and admin logins. Every attempt logged, every credential captured. A .env file leaking fake database strings, AWS keys, and Stripe secrets. SQL injection, XSS, path traversal, XXE, and command injection traps that answer with believable fake output. SQLMap gets a different database error on every request. Malicious crawlers wander an endless maze of random links. An optional tarpit adds delay and word salad that cost scrapers time, storage, and tokens. Optional AI-generated pages write a plausible decoy for any path an attacker requests. A hidden dashboard shows an attacker map, top IPs, captured credentials, and per-IP forensics. TLSH fuzzy hashing groups webshell variants into campaigns. A behavior score labels each IP attacker, bad crawler, good crawler, or regular user. Export bans as raw lists, iptables, or nftables rules, with guides for Fail2Ban, OPNsense, and RouterOS. A canary-token link in decoy pages emails you the IP and user agent of anyone who follows it. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.