Respotter

This application detects active instances of Responder by taking advantage of the fact that Responder will respond to any DNS query. Respotter uses LLMNR, mDNS, and NBNS protocols to search for a bogus hostname that does not exist (default: Loremipsumdolorsitamet). If any of the requests get a response back, then it means Responder is probably running on your network.

GitHub - lawndoc/Respotter: Respotter is a Responder honeypot! Catch attackers and red teams as soon as they spin up Responder in your environment.GitHub