Catch intruders on your network with a honeypot and Canarytokens
Nobody in your house has any reason to log in to a backup NAS that doesn't exist. So when something does, you know straight away. Turn a Raspberry Pi or old laptop into a fake file server with OpenCanary, scatter Canarytokens through your files, cloud drive and inbox, and get a push alert the moment anything touches them. Detection with almost zero false alarms, for free.
- Canarytokens in your documents, cloud drive, inbox and a fake AWS keys file, with a placement plan
- A short response plan for the day one goes off
- A Raspberry Pi (3B+ or newer, Pi 4 or 5 recommended) with Raspberry Pi OS Lite 64-bit, or any old laptop or mini PC with Ubuntu 24.04. It must be on your home network by cable or Wi-Fi
- SSH access to that box. If you've never used SSH, Terminal survival kit covers it
- The ntfy app on your phone (free, no account) and an email address for Canarytoken alerts
- Optional: Build a home SIEM to send honeypot alerts into Wazuh alongside everything else
Why honeypots catch what antivirus misses
Understand why a fake target gives you near-perfect alerts.
The problem with normal detectionAntivirus and SIEM rules look for known-bad behaviour inside a flood of normal activity, so they either miss things or cry wolf. An attacker who got in with a stolen password looks like you.
A honeypot flips itIt's a fake service nobody legitimate uses. You never tell anyone about it, nothing points to it, and nothing on your network has a reason to connect. So any connection is suspicious by definition: a compromised laptop scanning for other targets, a smart device behaving badly, a guest's infected phone, or a person on your Wi-Fi who shouldn't be there.
What attackers do after they get inThe first thing almost any intruder or worm does on a new network is look around: which machines exist, which ones have file shares, admin panels and databases. A box called
nas-backup-01with a login page on port 80 and FTP on port 21 is the most tempting thing on the network. When they knock, you hear it.Two kinds of tripwire in this missionOpenCanary is a network honeypot from Thinkst, the company behind the commercial Canary appliances. It runs fake services on a box you own. Canarytokens are tripwires inside files and data: a Word document, a folder, a set of AWS keys, a link. When someone opens or uses one, it phones home and you get an email.
TipZero cost if nothing happens. A honeypot that never fires costs you nothing but a few watts. The day it does fire, it's the most valuable alert you'll ever get.