# Deceptifeed

Deceptifeed is a self-hosted honeypot and threat feed server for homelab networks. It is open source and self-hosted, installable on Docker Hub and Unraid.

Canonical page: https://ourlocalhost.com/app/248/deceptifeed

## Description

Deceptifeed is a self-hosted honeypot and threat feed server for homelab networks. It runs multiple deceptive network services, records interacting IP addresses, and exposes real-time logs and a threat feed. It is for security-minded users who want to observe scanning and probing activity without exposing production systems.

## Platform availability

Available on 1 of 9 platforms: Unraid.

## Health score

50/100 (Fair), based on 3 of 4 factors.
- Maintained: 70 (last commit 101 days ago)
- Popular: 43 (140 GitHub stars)
- Easy to install: 20 (1 install platform, Docker image)

## Links

- Docker Hub: https://hub.docker.com/r/deceptifeed/server
- Unraid: https://ca.unraid.net/apps/deceptifeed-0rdqqju1oh3x0e?q=Deceptifeed

## Common questions

### How many ports does Deceptifeed use?

It runs as a single server application but listens on multiple ports for the honeypots and the threat feed.

### Should I expose the threat feed API to the internet?

No, you should only expose the honeypot servers to the internet. The threat feed server/API should stay private and refuses connections from public IPs.

### Does the threat feed track which IPs touched the honeypots?

Yes, the threat feed lists IP addresses that have interacted with the honeypots.

### Can I monitor honeypot activity as it happens?

Deceptifeed provides real-time visibility into honeypot activity and lets you monitor logs.

---
Source: Our Local Host (https://ourlocalhost.com/app/248/deceptifeed), the self-hosted and open-source app directory.