← Directory

Deceptifeed

Deceptifeed is a self-hosted honeypot and threat feed server for homelab networks.

  • Network Services
  • Other
  • Productivity
  • Tools & Utilities
Deceptifeed is a self-hosted honeypot and threat feed server for homelab networks. It runs multiple deceptive network services, records interacting IP addresses, and exposes real-time logs and a threat feed. It is for security-minded users who want to observe scanning and probing activity without exposing production systems.

Platform availability

Available on 1 of 9 platforms

  • Unraid
  • TrueNAS (not listed)
  • Umbrel (not listed)
  • ZimaOS (not listed)
  • Proxmox (not listed)
  • Helm (not listed)
  • Mac (not listed)
  • Windows (not listed)
  • Linux (not listed)

Health score?A 0-100 score computed nightly from four factors: maintained (40%: recent commits and steady activity), popular (25%: GitHub stars, log scale), easy to install (20%: platforms, install notes, setup guides, Docker image) and light to run (15%: minimum RAM, ARM support). When the source code has been checked, a fifth factor, security check (20%: automated scan for committed secrets, unsafe desktop-app settings, known-vulnerable dependencies and project hygiene; any serious finding caps it at 20), is added. Factors without data are left out and the rest are rescaled.

51/100 Fair

Maintained
71last commit 92 days ago
Popular
43140 GitHub stars
Easy to install
201 install platform, Docker image
Light to run
No data

Based on 3 of 4 factors.

Availability: platform listings confirmed today, links checked 17 days ago

GitHub stars
140
Open issues
3
Last commit
2026-07-14
Latest release
v0.69.0
License
MIT
Activity
stale

Checked 8 days ago - source: GitHub (r-smith/deceptifeed)

Resources & Compatibility

ARM (e.g. Raspberry Pi) is not supported.

Checked 16 days ago - source: Docker Hub image tags and published docs

First-install notes

No first-install notes yet.

Alternatives

No alternatives collected yet.

Common questions

How many ports does Deceptifeed use?

It runs as a single server application but listens on multiple ports for the honeypots and the threat feed.

Should I expose the threat feed API to the internet?

No, you should only expose the honeypot servers to the internet. The threat feed server/API should stay private and refuses connections from public IPs.

Does the threat feed track which IPs touched the honeypots?

Yes, the threat feed lists IP addresses that have interacted with the honeypots.

Can I monitor honeypot activity as it happens?

Deceptifeed provides real-time visibility into honeypot activity and lets you monitor logs.

Answers sourced from github.com, www.redditmedia.com

Community

Collected 16 days ago - public community threads