Customizing Conpot for Realistic ICS Emulation

Mon, 26 Jan 2026 00:00:00 +0000

The Problem with Default Templates

Conpot’s default template emulates an S7-200 PLC with whimsical configuration values clearly designed for demonstration purposes rather than realism. Examining the default template.xml reveals:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


<entity name="unit">S7-200</entity>
<key name="FacilityName">
 <value type="value">"Mouser Factory"</value>
</key>
<key name="SystemName">
 <value type="value">"Technodrome"</value>
</key>
<key name="sysLocation">
 <value type="value">"Venus"</value>
</key>

While functional for basic honeypot deployment, these values present several issues for research purposes:

Deploying an ICS Honeypot

Mon, 26 Jan 2026 00:00:00 +0000

As part of my MSc research in Information Security at Royal Holloway, University of London, I’ve been investigating the threat landscape facing industrial control systems (ICS) and SCADA infrastructure. One of the most effective ways to understand attacker behavior in this space is through honeypot deployment; specifically, using Conpot to emulate vulnerable industrial systems.

This post documents my process of deploying a production ICS honeypot on DigitalOcean, the technical considerations involved, and some initial observations from the deployment.

Security-Research on Corvus Blog

Customizing Conpot for Realistic ICS Emulation

The Problem with Default Templates

Deploying an ICS Honeypot