Mailoney

What Mailoney is

Mailoney is a self-hosted SMTP honeypot that imitates a vulnerable mail server to detect and log access attempts, credential harvesting, and other SMTP attacks. It accepts connections on port 25 and captures authentication attempts and credentials. Session data can be kept in SQLite, PostgreSQL, or MySQL/MariaDB, or the database can be disabled for event logging only; PostgreSQL is recommended for production. Mailoney can emit JSON Lines events for log shippers, and the project describes forwarding them to SIEM, ELK Stack, or Loki. An optional Prometheus endpoint reports connection, session, credential, command, and duration metrics. Captured email bodies are discarded unless you set `MAILONEY_MAIL_DIR` to save them. Deployment options include Docker and Docker Compose or local Python installation. STARTTLS is available when configured with a certificate and private key, with TLS 1.2 as the minimum. It is free under the MIT License and supports Linux and Windows. The project recommends controlled deployment, limited privileges, and firewall configuration; its unauthenticated metrics endpoint can reveal that it is a honeypot.