©2026 Luis Cobian, CobianSoft
cobian@cobiansoft.com

Cobian Honeypot is a cross-platform security application designed to detect and prevent unauthorized connections to your machine. 
It currently supports Windows and Linux, with possible macOS support planned for the future.

The application is plugin-based and runs as a Windows Service on Windows systems or as a daemon on Linux.

Cobian Honeypot allows you to open one or more ports and deploy a honeypot on them. Any incoming connection that is not explicitly excluded 
is handed off to the configured plugins for processing. Once handled, the connection is immediately terminated.

At present, one plugin is included. Its function is to automatically add a blocking rule to the system firewall—Windows Firewall on Windows 
or ufw on Linux—preventing the offending IP address from making future connections. The plugin also supports blocking an entire IP range using CIDR notation. 
For example, 134.32.24.0/24 blocks all 256 IP addresses within that network.

Currently, Cobian Honeypot is configured exclusively via the command line. A full graphical configuration tool is planned for a future release as
well as an installation program.

Installing on Windows:

1. Just unzip all the files in the desired directory, for example: C:\Program Files\Cobian Honeypot 

2. Open Powershell as an administrator 

3. Enter 

sc.exe create CobianHoneypot DisplayName="Cobian Honeypot" binPath= "yourpath"


where yourpath is the path to the honeypot-daemon.exe, example  C:\Program Files\Cobian Honeypot\honeypot-daemon.exe. Keep the quotes around the path.

4. Enter

sc.exe start CobianHoneypot

5. Start then manually honeypot.exe on the same directory in order to configure the service. You may want to create a shortcut to this executable 
for future use. 

Installing on Linux

1. On a sudo-ed bash, create a directory on /usr/local/bin/cobian-honeypot  (sudo mkdir -p /usr/local/bin/cobian-honeypot)

2- Unzip the files into that directory. (unzip cobian-honeypot-linux-x64.zip -d /usr/local/bin/cobian-honeypot)

3. Ensure the executables are actually executable: 

sudo chmod +x /usr/local/bin/cobian-honeypot/honeypot  

and

sudo chmod +x /usr/local/bin/cobian-honeypot/honeypot-daemon

4- Create the systemd service unit

sudo nano /etc/systemd/system/cobian-honeypot.service

Put this in he file:

[Unit]
Description=Cobian Honeypot Daemon
After=network.target

[Service]
Type=simple
User=root
Group=root

WorkingDirectory=/usr/local/bin/cobian-honeypot
ExecStart=/usr/local/bin/cobian-honeypot/honeypot-daemon
Restart=always
RestartSec=3

Environment=DOTNET_ENVIRONMENT=Production
Environment=DOTNET_PRINT_TELEMETRY_MESSAGE=false

# Enable dumps for debugging
LimitCORE=infinity

[Install]
WantedBy=multi-user.target

5- Reload systemd

sudo systemctl daemon-reload

6- Enable the daemon

sudo systemctl enable cobian-honeypot.service

7- Start the daemon

sudo systemctl start cobian-honeypot.service

8- Check the status

sudo systemctl status cobian-honeypot.service --no-pager

9- Add /usr/local/bin/cobian-honeypot to the system path for all users if you like 

sudo nano /etc/profile.d/honeypot.sh
export PATH="/usr/local/bin/cobian-honeypot:$PATH"
sudo chmod 644 /etc/profile.d/honeypot.sh  (set permissions and log out/log in again)

