https://www.ashimmahara.com/tags/honeypots/Recent content in Honeypots on Ashim MaharaHugoen-usWed, 29 Jul 2026 01:27:31 -0400https://www.ashimmahara.com/writing/terminal_mcp_honeypot/Thu, 19 Feb 2026 00:00:00 +0000https://www.ashimmahara.com/writing/terminal_mcp_honeypot/<p>Sooo, it was quite interesting to see that there is a <code>docker diff</code> command in the <a href="https://docker-py.readthedocs.io/en/stable/containers.html#docker.models.containers.Container.diff">docker-py</a> sdk. This immediately piqued my curiousity around the possible use-cases of the feature. One thought that immediately came to me was <code>honeypots</code>.</p> <h2 id="honeypots">Honeypots</h2> <p>Honeypots - and honeytokens / canary tokens - are quite possibly the greatest ROI tool in the defensive cybersecurity realm. Their main goal is to capture attacker tradecraft and provide signals around trends in global security like data collected at scale by companies like <a href="https://www.greynoise.io/">GreyNoise</a>. In comparison, honeytokens/ canary tokens (<a href="https://www.securityengineering.dev/the-beginners-guide-to-honeytokens-aka-canary-tokens/">article from security engineering.dev</a>) are used as an early detection mechanism that provide early alerts.</p>