honeypot-ftp (alexbredo)¶
Status: Informative · evaluation proof
Upstream: https://github.com/alexbredo/honeypot-ftp · GitHub last push 2024-01-22
Runtime: honeypot-ftp:uhbs-lab (lab stubs for missing base/handler common-modules; plain FTP only)
What this decoy is¶
Plain FTP honeypot (lab graded non-TLS FTP).
Protocol survey¶
| Surface | UHBS plugin? | Graded? | Quick | Full |
|---|---|---|---|---|
| FTP | yes | yes (plain :21) |
42.71 / F | 42.6 / F |
FTPS :990 |
yes (ftp) |
no (lab skips SSL) | — | — |
For CTI analysts¶
- Captures FTP credential and file-oriented probing.
Primary signals you can expect (when logging is wired): FTP auth and file commands.
For blue teams / detection engineering¶
- Prefer disposable storage; monitor uploads for malware drops if enabled.
Trust & limitations¶
- This page is evaluation proof under UHBS 4.2.2 — not a certification or vendor ranking.
- Prefer full/ artifacts over quick/ for operational decisions.
- Re-run via TUTORIAL.md; environment notes in METHODOLOGY.md.
- How to read modules: READING-UHQS.md