k0Pot

A lightweight honeypot built to help you understand what happens, not just log it. Instead of deploying a couple dozen honeypots on a heavy logging stack, it reuses proven decoys for SSH and Telnet and adds native Go traps for HTTP, Redis and FTP, plus the layer that is usually missing: translating attacks into language you can understand without being an analyst. It groups the thousands of daily events into "episodes" (the full sequence of a single attacker) and sorts them by what they achieved —touch, probe, access, intrusion—, not by how much they insisted, so the one episode that truly matters is not buried. It answers, in order, three questions: should I worry?, what happened? and what does it mean?

Features

• Episodes by severity (touch / probe / access / intrusion): groups events into attacks and sorts them by what they achieved, not by volume
• Unified search and filters: by IP, country, provider, service or by what they did; with minimum severity and service (SSH, Telnet, HTTP, Redis, FTP)
• Per-attack AI explanation: what they wanted, what they achieved and what it would mean on a real server, framed as a decoy and not a compromised system
• Free rule-based reports; AI is only invoked on demand and what is already generated is kept
• Exports a self-contained HTML report with each attack full sequence, printable to PDF and usable as evidence
• Alerts via push notification, messaging or your own webhook: only what is serious, one per attack and with a test send
• Per-user "since your last visit" counter, with explicit mark-as-seen
• City-level geolocation from a local database (no third-party calls), HTTPS panel and hardening with a systemd sandbox