# Honeypot

> A fake target set up on purpose to attract attackers, so you can spot them and watch them.

- Level: Intermediate
- Topics: Security
- URL: https://tidbit.legios.com.ar/honeypot/
- In Spanish: [Honeypot](https://tidbit.legios.com.ar/es/honeypot/)

A **honeypot** is a computer, service or file that looks real and valuable but exists only to be attacked. No legitimate user has any reason to touch it, so any connection to it is suspicious by definition. That makes it a very quiet, very reliable alarm: instead of sifting through millions of normal events looking for an intruder, you wait for someone to bite.

Some honeypots are research tools. A security team leaves a deliberately weak server open on the internet and records everything that happens: which passwords bots try, what malware they drop, which commands a human attacker types. Many of the reports you read about new botnets come from this kind of trap. A network of them is called a **honeynet**.

Inside companies the goal is early warning. A fake server named something like `payroll-db` or `admin-backup`, a fake admin account, or a **honeytoken** (also called a canary token): a fake password, API key or document planted where only an intruder would look. If it is ever used or opened, an alert goes straight to the security team. Honeypots must be isolated so an attacker cannot use them as a stepping stone, and they only catch attackers who come looking, so they complement normal defenses rather than replace them.

## An analogy

A shop leaves a decoy wallet with a tracker on the counter. No customer has any business picking it up, so the moment it moves, the owner knows exactly who to watch.

## Keep in mind

- A decoy with no legitimate use: anyone who touches it is a suspect.
- Research honeypots study attackers; company honeypots raise early alarms.
- Honeytokens are fake credentials or files that alert when used or opened.
- Must be isolated, and only catch attackers who go looking.

## Go deeper

- [Honeypot (computing) on Wikipedia](https://en.wikipedia.org/wiki/Honeypot_(computing))
- [The Honeynet Project](https://www.honeynet.org/)

## Related terms

- [Server](https://tidbit.legios.com.ar/server/): A computer whose job is to answer requests from other computers, all day, every day.
- [Internet](https://tidbit.legios.com.ar/internet/): A worldwide network of networks that lets any connected device reach any other.
- [Malware and ransomware](https://tidbit.legios.com.ar/malware-and-ransomware/): Software built to harm you; ransomware locks your files and charges to unlock them.
- [DDoS](https://tidbit.legios.com.ar/ddos/): Knocking a site offline by flooding it with more traffic than it can handle.
- [API key](https://tidbit.legios.com.ar/api-key/): A secret string that identifies your app when it calls someone else's API.