- Home
- Honeypot Software
- Mailoney
Mailoney
What it is
Mailoney is a self-hosted, low-interaction SMTP honeypot that imitates a vulnerable mail server to detect and record unauthorized access, credential harvesting, and other SMTP attacks. It listens on port 25 and captures authentication attempts and credentials. Session data can be stored in SQLite, PostgreSQL, or MySQL/MariaDB, or storage can be disabled for event-only logging; PostgreSQL is recommended for production. JSON Lines events can feed log shippers, with documentation describing SIEM, ELK Stack, and Loki use. An optional Prometheus endpoint reports connection, session, credential, command, and duration metrics. Captured email bodies are discarded by default, while `MAILONEY_MAIL_DIR` enables disk storage. STARTTLS requires a certificate and matching private key, with TLS 1.2 minimum. Docker, Docker Compose, and Python installation methods are provided. Mailoney supports Linux and Windows and uses the MIT License. The project advises controlled deployment, limited privileges, firewall configuration, and keeping its unauthenticated metrics endpoint off the internet.
For and against
For
- Captures SMTP credentials on port 25
- Supports three database systems
- Emits JSON Lines security events
- Optional Prometheus metrics
- MIT License permits free use
Against
- Unauthenticated metrics can expose the honeypot
- Requires controlled deployment and firewalling
- Email bodies are discarded by default
- REST API is not built in
The verdict
Mailoney offers a focused SMTP honeypot with flexible storage, log forwarding, metrics, and optional TLS. Its warnings about exposure and privileges make deployment controls an essential part of using it.
Who it suits
Mailoney suits security teams and administrators who need a self-hosted SMTP decoy for observing attacks and credential attempts. It fits Linux or Windows deployments using Docker or Python.
On the record
- API
- The README suggests extending Mailoney to provide a REST API; it does not describe a built-in API.github.com · read 4 Oct 2026
- Database
- Session data can be stored in SQLite, PostgreSQL, or MySQL/MariaDB; PostgreSQL is recommended for production.github.com · read 4 Oct 2026
- Deployment
- The project documents Docker and Docker Compose deployment, plus local installation from the Python package source.github.com · read 7 Oct 2026
- Latest release
- The releases page lists version 2.1.0 and says it added destination IP and port logging for SMTP sessions.github.com · read 7 Oct 2026
- License
- The repository identifies Mailoney as MIT-licensed.github.com · read 7 Oct 2026
- Log forwarding
- Mailoney can emit JSON Lines events for log shippers and describes forwarding or connecting collected data to SIEM and other security tools.github.com · read 7 Oct 2026
- Log integrations
- JSON Lines event output can be used with log shippers, and the README describes shipping logs to SIEM, ELK Stack, or Loki.github.com · read 4 Oct 2026
- Maker
- The GitHub profile identifies the maintainer as Brandon E. and describes his focus as cloud and container security.github.com · read 7 Oct 2026
- Message retention
- Captured message bodies are discarded by default; setting MAILONEY_MAIL_DIR opts in to saving them as .eml files.github.com · read 7 Oct 2026
- Metrics exposure
- The unauthenticated metrics endpoint binds to loopback by default, and the project warns that exposing it can reveal the software name and version.github.com · read 7 Oct 2026
- Prometheus
- An optional Prometheus /metrics endpoint exposes SMTP connection, session, credential, command, and duration metrics.github.com · read 7 Oct 2026
- Purpose
- Mailoney is a low-interaction SMTP honeypot that simulates a vulnerable mail server to detect and log unauthorized access attempts, credential harvesting, and other SMTP-based attacks.github.com · read 7 Oct 2026
- Security guidance
- The project advises deploying the honeypot in a controlled environment, limiting privileges, and configuring a firewall to prevent misuse.github.com · read 7 Oct 2026
- SMTP capture
- It accepts SMTP connections on port 25 and captures authentication attempts and credentials.github.com · read 4 Oct 2026
- SMTP listener
- It simulates an SMTP server accepting connections on port 25 and captures authentication attempts and credentials.github.com · read 7 Oct 2026
- STARTTLS
- Mailoney supports SMTP STARTTLS when a certificate and matching private key are configured, with TLS 1.2 as the minimum handshake version.github.com · read 7 Oct 2026
- Storage
- Session data can be stored in SQLite, PostgreSQL, or MySQL/MariaDB, and the database can be disabled for event-logging-only operation.github.com · read 7 Oct 2026
- TLS
- The SMTP server supports STARTTLS when both a certificate and private key are configured, with a TLS 1.2 minimum.github.com · read 4 Oct 2026
