ThreatLens: An Intelligent IoT Honeypot for Cyber-Attack Monitoring and Threat Analysis Using ESP32

Internet of Things devices are deployed in homes, offices, and industrial settings with little regard for the security of the firmware or the network stack running on them, and this makes them a persistent target for automated scanning, credential-stuffing, and botnet-recruitment campaigns. Most defensive research in this space relies on honeypots running on general-purpose computers or cloud instances, which do not reproduce the resource constraints or network footprint of an actual embedded device. This paper presents ThreatLens, a low-cost IoT honeypot built directly on an ESP32 microcontroller that exposes a decoy router login portal, a live ultrasonic-sensor status page, a simulated Telnet shell, and a set of common-service reconnaissance traps to attract and record unauthorized access attempts. Captured events are queued on-device and forwarded over Wi-Fi to a Flask ingestion service, which stores them in a SQLite database alongside a sliding-window rule for flagging brute-force behaviour, and a React dashboard polls the same backend to give an analyst a live view of activity. The paper describes this five-part architecture — edge firmware, log transport, backend storage, analysis, and dashboard — and reports the current implementation and validation status. The system has been built and exercised with a synthetic test harness that reproduces page views, reconnaissance probes, and brute-force sequences end to end, but it has not yet been deployed on a live network, so no field attack data is reported; we describe the test setup used so far, what it does and does not cover, and the deployment work remaining before real-world evaluation.