Beelzebub is a secure, low-code open-source honeypot framework powered by AI and LLMs that simulates realistic systems to detect, analyze, and respond to cyber threats, ideal for security engineers and DevOps teams in cloud-native environments.

---

🚀 Overview

Beelzebub is an AI-native honeypot framework that deploys high-interaction decoys using large language models (LLMs) to mimic real systems such as Linux servers, APIs, databases, IoT devices, and AI agents. It enables quick deployment in 1-2 minutes via Docker or Kubernetes, providing a safe environment to lure and study attackers without risk.

This project solves key problems in traditional honeypots: high false positives, lack of realistic interactions, supervision needs, and limited scalability. It delivers zero false positives, autonomous threat response, and high-fidelity intelligence to cut SOC costs by 60% and MTTR from hours to seconds.

Built for security teams at Fortune 500 companies in telecom, finance, and critical infrastructure, as well as DevOps handling Kubernetes, cloud (AWS, Azure, GCP), or on-premises setups. Mario Candela created it to pioneer AI deception for advanced threats like lateral movement and prompt injection attacks, ensuring compliance with NIS2, DORA, SOC 2, and GDPR.

---

✨ Key Features

• AI-Powered Decoys: Uses LLMs (OpenAI, Ollama, etc.) for high-interaction simulations of SSH, HTTP/HTTPS, TCP/TELNET, databases (MySQL/PostgreSQL), MCP for AI agent security, and IoT—engaging attackers realistically for hours.
• Zero False Positives: Centralized dashboard with real-time analysis; triggers only on real threats.
• Autonomous SOC: AI-driven malware sandbox, network analysis, isolation, reports, and post-mortems.
• Low-Code & Scalable: YAML configs deploy thousands of varied honeypots from one instance; Prometheus metrics, ELK/RabbitMQ integration.
• Upcoming: Enhanced MCP for prompt injection, more protocol support.

---

🛠 Tech Stack

• Backend: Go (98%+ codebase)
• Deployment: Docker, Kubernetes (Helm chart), docker-compose
• AI/LLMs: OpenAI, Ollama, Anthropic, Gemini, Grok, OpenRouter
• Observability: Prometheus (/metrics endpoint), ELK Stack, RabbitMQ for events
• Auth: N/A (honeypot framework)
• Hosting: Self-hosted (Vercel-like flexibility via Docker/K8s on any cloud or on-prem)

---

👥 Who Is This For?

This project is useful for:

• Developers who want to deploy AI honeypots for threat hunting and intel
• Teams looking for lateral movement detection in K8s/cloud with zero supervision
• Indie makers building custom deception tools for AI security and compliance

---

📸 Screenshots / Demo

• Live demo: https://beelzebub-honeypot.com (schedule via /contact/ for managed platform)
• GitHub: https://github.com/mariocandela/beelzebub
• Docs & Examples: https://docs.beelzebub.ai

---

🔥 Project Status

• 🟢 Actively building

Last updated: 2026-03-24

---

❓ FAQ

Is this project free?

Yes / Freemium — Open-source self-hosted core is free; managed platform with AI SOC, central mgmt, 24/7 support is enterprise paid (1.8K+ GitHub stars, 450+ weekly installs).

Is the source code available?

Yes — https://github.com/mariocandela/beelzebub (GNU GPL v3 license, 1.9k stars, 182 forks)

Can I contribute?

Yes — Fork the repo, open issues for bugs/features, submit PRs. Join 15+ contributors; feedback via GitHub discussions or issues.

---

📬 Contact & Links

• Website: https://beelzebub-honeypot.com
• GitHub: https://github.com/mariocandela
• Twitter/X: https://x.com/m4r10c4nd3l4 (Mario Candela), https://x.com/BeelzebubLabs
• Email: Schedule demo on site (no public email listed)

---

Built with ❤️ and kept warm on WarmIndex.