Beelzebub Honeypot on Ubuntu 24.04

Overview

Beelzebub is a self hosted honeypot and deception framework. It stands up low interaction decoy services that impersonate real infrastructure, a fake SSH shell, a fake web server, a fake database, so that any connection to them is suspicious by definition. Each decoy is defined in simple YAML, and every interaction is captured as a structured event and exposed as Prometheus metrics, giving you an early warning tripwire for reconnaissance and intrusion attempts. Because nothing legitimate should ever touch a decoy, a single hit is a high signal, low noise alert, unlike scanning production logs for anomalies. The decoys run inside Beelzebub's own sandbox, so they present an inviting target while granting no real access to the host, and you can extend or replace them with your own service definitions.

It suits security teams who want an internal tripwire that fires the moment something touches a service it should not, researchers studying attacker behaviour, and defenders who want to slow and misdirect an intruder who has already gained a foothold.

Common uses

• An internal tripwire that alerts the moment an attacker touches a decoy service
• A research sensor for studying reconnaissance and intrusion behaviour
• A deception layer that slows and misdirects an intruder inside your network