MCHoneypot

A simple Python honeypot that mimics a Minecraft server to log scans and connection attempts.

---

Features

• Responds to Minecraft status pings
• Logs IP, country, and ISP
• Tracks login attempts (username + IP)
• Basic per-IP rate limiting
• Optional Discord webhook alerts
• Optional Abuseipdb reporting
• Config-driven setup via config.json

---

Requirements

• Python 3
• requests module

Install dependencies:

pip install -r requirements.txt

---

Configuration (config.json)

The honeypot is fully controlled via a config file:

{
  "enable_reports": false,
  "abuseip_api_key": "your-abuseip-api-key-here",
  "abuseip_reason_message": "Minecraft server scanning dectected on port 25565",
  "webhook_url": "your-webhook-here",
  "enable_webhook": false,
  "logs_directory": "logs",
  "logs": "logs/honeypothits.txt",
  "pureiplogs": "logs/honeypotips.txt",
  "bind_host": "0.0.0.0",
  "port": 25565,
  "max_pings": 5,
  "time_window": 300,
  "cleanup_interval": 60,
  "cache_ttl": 86400,
  "report_ttl": 1800,

  "response": {
    "version": {
      "name": "1.21.11",
      "protocol": 774
    },
    "players": {
      "max": 20,
      "online": 4,
      "sample": [
        { "name": "Notch", "id": "069a79f4-44e9-4726-a5be-fca90e38aaf5" },
        { "name": "Herobrine", "id": "f84c6a79-0a4e-45e0-879b-cd49ebd4c4e2" },
        { "name": "Dinnerbone", "id": "61699b2e-d327-4a01-9f1e-0ea8c3f06bc6" },
        { "name": "popiiumaa", "id": "6f22dc59-9977-43ba-8699-dcf481600a1c" },
        { "name": "a2naly", "id": "fe045873-ba4b-4517-86f6-0bd0fb256a75" }
      ]
    },
    "description": {
      "text": "we love honey ;)"
    },
    "favicon": "data:image/png;base64,..."
  },

  "kick_message": {
    "text": "minescan.xyz honeypot caught your scanner ;)",
    "color": "yellow"
  }
}

---

Usage

python honeypot.py

Default bind:

0.0.0.0:25565

---

Output Files

Log files are written to the directory specified by logs_directory in config.json.

• logs — detailed hit log with timestamps, country, and ISP
• pureiplogs — plain list of IPs, one per line

---

Notes

For logging and research purposes only.