j0mbie Ping Test | Crypto Honeypot

Crypto Honeypot

Crypto Honeypot is a basic program and windows service that scans a list of files you select for changes. These are "dummy" files that you set up in various locations. If one of the files is changed, it immediately stops the "Server" service, thus cutting all file sharing, and sends out an email with an alarm.

For this program to work correctly, it has to be installed on your file server (the one sharing out your files) and run as a service. It is recommended that you set honeypot files randomly around your file share(s), as well as some honeypots that will come first alphabetically, as a lot of ransomware encrypts in alphabetical order.

This program will NOT protect against crypto run locally on your server. It will only help stop crypto run on a client computer that has access to those file shares. The service will shut itself down if it gets triggered so it doesn't keep triggering. If it is triggered and you don't receive an email, check the Event Log.txt file in the ProgramData folder.

Email notification requires an SMTP relay. If you are using Microsoft 365, Option 3 has been proven to work, in this link.



Screenshot 01

Screenshot 02