compare
Beelzebub vs Cowrie
The same facts for both, read from GitHub every night, and the relation a person reviewed.
| Fact | Beelzebub | Cowrie |
|---|---|---|
| Language | Go | Python |
| Licence | GPL-3.0 | Other |
| Stars | 2.2k | 6.7k |
| Latest | v3.10.0 | v3.1.6 |
| Last push | 2026-11-03 | 2026-11-12 |
| Release cadence | about 30 days between releases | about 7 days between releases |
| Active contributors | 5 commit authors on the default branch in the last 90 days | 16 commit authors on the default branch in the last 90 days |
| Flags | none | none |
How they relate
Both replace Thinkst Canary. Alternatives to Thinkst Canary →
PartialBeelzebubConfigurable honeypot that fakes SSH, HTTP and other services and logs attackers; no hardware devices or canary tokens.
PartialCowrieSSH and Telnet honeypot that logs attacker sessions, without the hosted console or other device types.
Beelzebub
- v3.10.02026-10-27fix: remove host-specific Redis values
- v3.9.22026-09-23build(deps): bump github.com/mark3labs/mcp-go from 0.58.0 to 1.0.0 by @dependabot[bot] in
- v3.9.12026-08-31docs: Added note on LLMhoneypot guardrails in the README
- v3.9.02026-08-05build(deps): bump golang.org/x/term from 0.43.0 to 0.44.0 by @dependabot[bot] in
- v3.8.02026-06-02build(deps): bump github.com/melbahja/goph from 1.5.0 to 1.5.1 by @dependabot[bot] in
Cowrie
- v3.1.62026-11-09fix(ssh): answer unexpected key exchange messages with SSH_MSG_UNIMPLEMENTED
- v3.1.52026-11-02fix(shell): expand $$ to the shell's process ID
- v3.1.42026-10-26fix(curl): accept options after the URL
- v3.1.32026-10-19fix(shell): require an execute bit to run a file by path
- v3.1.22026-10-12build(deps-dev): bump setuptools-scm from 10.2.3 to 10.3.4 by @dependabot[bot] in
Beelzebub
✓ signed The latest release, v3.10.0, carries a signature GitHub verified.
Loading the security report
Cowrie
unsigned The latest release, v3.1.6, carries no signature GitHub could verify.
Loading the security report