TR-16 - HoneyBot Services - Client Data Collection

You can report incidents via our official contact including e-mail, phone or use the Anonymous reporting form.


CIRCL is accredited TI CIRCL is a FIRST member CIRCL is an OASIS member


CIRCL Honeybot logo

CIRCL HoneyBot services consist of the distributed operation and exploitation of CIRCL HoneyBots. These services are part of a research project with the aim to improve security on Internet. A CIRCL HoneyBot is a low-interaction honeypot running on an embedded device, that is deployed in the premises of CIRCL partners. The HoneyBot listens to unused IP addresses specified by the partner. The HoneyBot sensor located in an unused network space of the partner (from one IP address to multiple IP addresses). The unused network space has no production network traffic and the traffic reaching such network space can be called background noise. This background noise contains malicious opportunistic attacks along with other traffic like backscatter traffic due to DDoS or misconfigurations. The CIRCL HoneyBot project is now part of the D4 project.



Interested parties, having available public IP address space located in Luxembourg, can request a HoneyBot service by contacting CIRCL. CIRCL is evaluating the request and notifies the requester as soon as possible. If the requester is interested in publicly mentioning its participation to the research project, a logo can be used on the CIRCL map visualization.

Classification of this document

TLP:WHITE information may be distributed without restriction, subject to copyright controls.


  • Version 1.1 January 09, 2019 HoneyBot is now part of the D4 Project
  • Version 1.0 October 14, 2013 Initial version (TLP:WHITE)