A standalone PHP honeypot server that emulates CMS installations (WordPress, Drupal, Joomla) to detect and report malicious traffic to the reportedip.de API.

Zero external Composer dependencies. Runs on vanilla PHP 8.2+. Uses SQLite for persistence.

We're looking for testers and community members!

We are actively searching for test users and contributors who want to help improve the data quality and detection coverage of reportedip.de. Every honeypot instance you run contributes attack data that helps protect the entire community.

To get started, you need a Community Access Key (API key). Please contact us at 1@reportedip.de to request your key. It's free.

Whether you're running a small VPS, a shared hosting account, or a dedicated server — every installation helps.

• CMS Emulation — Realistic WordPress, Drupal, and Joomla front-ends with login pages, admin panels, REST APIs, RSS feeds, sitemaps, and vulnerability paths
• 36 Threat Analyzers — SQL injection, XSS, path traversal, brute force, credential stuffing, SSRF, XML-RPC abuse, plugin exploits, config file access, and more
• Automatic Reporting — Detected threats are queued and batch-reported to the reportedip.de API with rate limiting and exponential backoff
• Webhooks — Forward detections in real time to your own logging/SIEM systems or third-party abuse databases (AbuseIPDB, Slack, Discord, custom APIs) with configurable methods, headers, body templates, and optional HMAC-SHA256 signatures
• Admin Dashboard — Web-based panel for monitoring attacks, viewing statistics, managing whitelists, and generating AI content
• AI Content Generation — Optional OpenAI integration to generate realistic blog posts for the fake CMS (AJAX-based, one post at a time to avoid timeouts)
• Bot Detection — Classifies visitors as good bots, bad bots, AI agents, hackers, or humans
• Cloudflare Support — Real IP resolution behind Cloudflare and custom reverse proxies via trusted_proxies config
• Security Hardened — CSRF protection, bcrypt auth, brute-force lockout, security headers (CSP, X-Frame-Options, HSTS), session IP binding
• Docker Ready — Ships with Dockerfile and docker-compose for instant deployment
• Zero Dependencies — No external Composer packages; built-in PSR-4 autoloader fallback

• PHP 8.2+
• Extensions: pdo_sqlite, curl, json
• Web server (nginx or Apache) with all requests routed to public/index.php

git clone https://github.com/reportedip/honeypot-server.git
cd honeypot-server
docker compose -f docker/docker-compose.yml up -d

Open the container URL in your browser — the web installer starts automatically on first visit.

git clone https://github.com/reportedip/honeypot-server.git
cd honeypot-server

Configure your web server:

• nginx — Copy config/nginx.conf.example and adjust paths
• Apache — Copy config/apache.htaccess.example to your document root

Then open the website URL in your browser. The web installer starts automatically when no config/config.php exists and guides you through:

1. System requirements check (PHP 8.2+, required extensions)
2. Community Access Key — contact 1@reportedip.de to get yours (free)
3. CMS profile selection (WordPress / Drupal / Joomla)
4. Admin panel path and password
5. Optional AI content settings (OpenAI API key, model, language)
6. Automatic initialization (database, directories, IP whitelist)

By default, the honeypot uses web cron mode: the report queue is automatically processed in small batches (2 reports) after every page visit. No external cron job is needed. This is ideal for shared hosting.

For high-traffic installations, switch to cron mode in config/config.php:

'queue_mode' => 'cron',

Then set up a cron job:

# Process the report queue every 5 minutes
*/5 * * * * php /path/to/honeypot-server/cli.php process-queue

Cleanup of old entries runs automatically in both modes.

All settings are in config/config.php (generated by the installer). See config/config.example.php for defaults and documentation.

Each profile emulates a specific CMS with realistic URL patterns, HTTP headers, and response templates:

The DetectionPipeline runs 36 analyzers on every request:

Each detection produces a DetectionResult with category IDs (mapped to reportedip.de categories), severity score (1-100), and a human-readable comment.

Access the admin panel at your configured path (default: /_hp_admin).

• Dashboard — Attack statistics, activity chart, top IPs, top categories, cron status, system info
• Logs — Filterable attack log with search, IP filter, category filter, status filter
• Whitelist — Add/remove IPs and CIDR ranges from the whitelist
• Content — Manage AI-generated blog posts for the fake CMS
• Visitors — Bot/visitor classification log with type breakdown
• Webhooks — Manage external report targets (see Webhooks)
• Updates — Self-update via GitHub Releases with backups and rollback

• Bcrypt password authentication with brute-force lockout (5 attempts, 15-minute window)
• CSRF protection on all state-changing actions (including logout)
• Session IP binding to prevent session hijacking
• Security headers: X-Frame-Options: DENY, Content-Security-Policy, X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy, Cache-Control: no-store
• SameSite=Strict and HttpOnly session cookies

Besides the automatic reporting to reportedip.de, the honeypot can forward every detection to your own systems (SIEM, log management, chat alerts, custom dashboards) or third-party abuse databases like AbuseIPDB in real time. Webhooks are managed in the admin panel under Webhooks.

• Each webhook is an HTTP(S) endpoint that receives a request for every matching detection
• HTTP method (POST/PUT/PATCH/GET), custom headers (e.g. API keys), and body format are configurable per endpoint
• Delivery happens after the trap response has been sent to the attacker, so webhooks never slow down the honeypot
• Filters: restrict a webhook to specific category IDs and/or analyzer names. Empty filters = all detections. When both filters are set, the webhook triggers when either one matches
• Test button: every webhook can be verified from the admin panel with a test delivery (X-ReportedIP-Event: test). Test deliveries use the loopback IP 127.0.0.1, so abuse databases reject them instead of storing a real report
• Delivery status, timestamp, and consecutive failure count are shown per webhook
• Quick presets in the admin form fill in URL, method, headers, and body template for AbuseIPDB, Slack, Discord, and generic JSON — just add your API key afterwards

Available in custom body templates and in the endpoint URL (for GET-style APIs):

{{ip}}, {{categories}}, {{abuseipdb_categories}}, {{comment}}, {{severity}}, {{analyzers}}, {{uri}}, {{method}}, {{user_agent}}, {{host}}, {{timestamp}}, {{version}}, {{event}}

Each placeholder also exists as {{name_url}} (URL-encoded) and {{name_json}} (JSON-escaped). Multiple detections in one request are aggregated: categories are merged, severity is the maximum, comments are joined.

{{abuseipdb_categories}} automatically translates reportedip.de category IDs to AbuseIPDB category IDs (IDs 1–23 are identical on both platforms; the CMS-specific IDs 24–58 map to their closest equivalent, e.g. WP Login Brute Force → Brute-Force + Web App Attack).

Use the AbuseIPDB preset in the admin form, or configure manually:

Note: AbuseIPDB accepts a report for the same IP only once every 15 minutes per reporter. The honeypot's built-in category cooldown (15 minutes by default) keeps duplicate submissions to a minimum; rejected duplicates show up as a delivery failure (HTTP 429) in the webhook status.

Custom headers configured on the webhook override the defaults (e.g. a custom Content-Type).

{
  "event": "detection",
  "generated_at": "2026-06-12T14:00:00+00:00",
  "honeypot": {
    "name": "reportedip-honeypot-server",
    "version": "1.3.1",
    "host": "your-honeypot.example.com",
    "profile": "wordpress"
  },
  "request": {
    "ip": "203.0.113.50",
    "method": "POST",
    "uri": "/wp-login.php",
    "user_agent": "sqlmap/1.7"
  },
  "detections": [
    {
      "analyzer": "SqlInjection",
      "categories": [16, 45],
      "category_names": ["SQL Injection", "Code Injection"],
      "comment": "SQL injection attempt detected: ...",
      "severity": 85
    }
  ]
}

When a secret is configured, verify the integrity of each delivery by computing the HMAC over the raw request body:

$expected = 'sha256=' . hash_hmac('sha256', $rawBody, $secret);
$valid = hash_equals($expected, $_SERVER['HTTP_X_REPORTEDIP_SIGNATURE'] ?? '');

php cli.php stats                        # Show attack statistics
php cli.php process-queue                # Send pending reports to API
php cli.php cleanup [--days=90]          # Remove old log entries
php cli.php whitelist-add <ip> [desc]    # Add IP/CIDR to whitelist
php cli.php whitelist-remove <ip>        # Remove IP from whitelist
php cli.php whitelist-list               # Show all whitelist entries
php cli.php test-api                     # Test API connectivity

reportedip-honeypot-server/
├── public/index.php              # Single entry point (document root)
├── cli.php                       # CLI tool for cron and management
├── config/
│   ├── config.example.php        # Configuration template
│   ├── nginx.conf.example        # Nginx config template
│   └── apache.htaccess.example   # Apache config template
├── src/
│   ├── Core/                     # App, Request, Response, Router, Config, Cache
│   ├── Detection/                # DetectionPipeline + 36 Analyzers
│   ├── Network/                  # IpResolver, CidrMatcher
│   ├── Persistence/              # Database, Logger, VisitorLogger, Whitelist
│   ├── Api/                      # ReportClient, ReportQueue
│   ├── Profile/                  # CmsProfile, WordPress/Drupal/Joomla profiles
│   ├── Content/                  # ContentGenerator, ContentRepository
│   ├── Admin/                    # AdminController, AdminAuth, Dashboard, LogViewer
│   └── Trap/                     # 13 trap handlers (Login, Admin, Home, Content, ...)
├── templates/
│   ├── admin/                    # Admin panel templates (layout, dashboard, logs, ...)
│   ├── wordpress/                # WordPress trap templates
│   ├── drupal/                   # Drupal trap templates
│   └── joomla/                   # Joomla trap templates
├── tests/                        # 311+ tests (unit + analyzer + integration)
├── docker/                       # Dockerfile, docker-compose.yml, nginx/php-fpm configs
└── data/                         # SQLite DB, cache, logs (gitignored)

The project uses a custom lightweight test framework (no PHPUnit dependency):

php tests/run-tests.php                  # Run all tests
php tests/run-tests.php --integration    # Include integration tests
php tests/run-tests.php --filter Config  # Filter by class name
php tests/run-tests.php --verbose        # Show timing per test

1. All HTTP requests hit public/index.php
2. IpResolver determines the real client IP (Cloudflare/proxy-aware)
3. Router checks if the request targets the admin panel
4. For honeypot requests: Whitelist check, then DetectionPipeline runs all 36 analyzers
5. Detections are logged to SQLite with sent=0 (queued for reporting)
6. Router matches the path against the active CMS profile to select a trap
7. The trap renders a convincing CMS-like response (login page, blog post, RSS feed, etc.)
8. After the response is sent, web cron processes a micro-batch of queued reports to the reportedip.de API (or a cron job does it in cron mode)

Contributions are welcome! Please read CONTRIBUTING.md for guidelines.

Patrick Schlesinger

• Website: reportedip.de
• Email: 1@reportedip.de

This project is licensed under the Business Source License 1.1 (BSL 1.1).

• Production use is permitted (including by companies), EXCEPT offering this software as a hosted/managed service to third parties or selling it as a commercial product.
• On 2030-03-01, the license automatically converts to Apache License 2.0.

See LICENSE for the full text.

By using this software, you agree to the terms in DISCLAIMER.md.

• No Warranty: This software is provided "AS IS" without warranty of any kind.
• Legal Compliance: You are solely responsible for compliance with all applicable laws in your jurisdiction regarding honeypot operation and data collection.
• Data Privacy: You are the data controller for any personal data (IP addresses) collected by this software.
• Risk: Running a honeypot involves inherent security risks. The authors are not liable for any damages.

Bitte beachten Sie den ausführlichen Haftungsausschluss in DISCLAIMER.md.