• 📂 Fake S3 Bucket — Simulates AWS S3 operations (GET, PUT, DELETE)
• 🔑 Fake AWS Credentials — Baits credential harvesters
• 🔐 Fake Admin Login Portal — Captures brute-force attempts
• 🗄️ Fake Database Config Leak — Exposes decoy secrets

• ⚡ 5-Provider AI Waterfall Engine
• 🧠 Groq → Gemini → OpenRouter → Rule-Based
• 📉 Logarithmic Threat Scoring
• 💾 SQLite Cached Profiles
• 🚨 5-Tier Threat Classification

• 🗺️ Global Threat Map with Curved Attack Flow Lines
• 📍 Geo-Located Attacker Markers
• 📊 Real-Time Event Feed
• 📜 Sliding Live Event Log Drawer
• 🧠 Animated AI Profile Cards
• 📈 Telemetry + Analytics Modules

• 🌎 25 Simulated Attackers from 15+ Countries
• 🕹️ 4 Simulation Speeds
• ⏱️ Auto-Termination Controls
• 🎛️ Dynamic Speed Adjustment

flowchart TD

A[🌐 External Attackers / Bots] --> B[🪤 Honeypot Trap Layer]

subgraph TrapLayer [Honeypot Services]
B1[Fake S3 Bucket]
B2[Fake AWS Credentials]
B3[Fake Admin Login]
B4[Fake DB Config Leak]
end

B --> B1
B --> B2
B --> B3
B --> B4

B1 --> C[📥 Event Capture Engine]
B2 --> C
B3 --> C
B4 --> C

C --> D[🌍 IP Geolocation Service]
D --> E[🗄️ SQLite Database]

E --> F[🤖 AI Profiling Engine]

subgraph AIEngine [Threat Intelligence Waterfall]
F1[Groq]
F2[Gemini]
F3[OpenRouter]
F4[Rule-Based Engine]
end

F --> F1
F --> F2
F --> F3
F --> F4

F --> G[📊 Threat Score Generation]

G --> H[⚡ React Dashboard]

subgraph Dashboard [Visualization Layer]
H1[Global Threat Map]
H2[Live Event Feed]
H3[AI Profile Cards]
H4[Telemetry]
H5[Analytics Charts]
end

H --> H1
H --> H2
H --> H3
H --> H4
H --> H5

I[🎮 Attack Simulator] --> B

cd backend

pip install flask flask-cors python-dotenv requests groq google-generativeai openai pdfplumber pandas

cp .env.example .env

python db.py
python app.py

cd frontend

npm install

npm run dev

Configure inside backend/.env

curl -X POST http://localhost:5000/admin/login \
-H "Content-Type: application/json" \
-d '{"user":"admin","pass":"admin123"}'

curl http://localhost:5000/aws/credentials

curl http://localhost:5000/fake-s3/prod-backup/db-dump.sql

Honeypot/
├── backend/
│   ├── uploads/
│   ├── app.py
│   ├── analyzer.py
│   ├── capture.py
│   ├── db.py
│   ├── simulator.py
│   ├── alerter.py
│   └── honeypot.db
│
├── frontend/
│   ├── src/
│   │   ├── App.jsx
│   │   ├── Dashboard.jsx
│   │   ├── ThreatMap.jsx
│   │   ├── ProfileCard.jsx
│   │   ├── Telemetry.jsx
│   │   └── ...
│   │
│   ├── package.json
│   └── vite.config.js
│
└── README.md

• Kubernetes Honeypot Support
• Machine Learning Anomaly Detection
• SIEM Integration
• Multi-Tenant Architecture
• Docker Deployment

Educational / Research Purposes Only

⚠️ Do not deploy honeypots without authorization.