lophiid¶
Status: Informative · evaluation gap (skip note)
Upstream: mrheinen/lophiid
Why UHBS did not publish UHQS for HTTP in this batch¶
Lophiid is a hybrid AI honeypot with a distributed backend/agent architecture. The maintained Quick Start path assumes OpenRouter API keys for AI triage/responders, optional VirusTotal integration, local CA generation, and multi-container Docker Compose wiring between backend and edge agents. This UHBS 4.2.2 lab batch runs under an air-gap constraint with no paid LLM API keys, so we cannot stand up the AI responder pipeline faithfully or grade HTTP engagement without inventing scores.
Static-only rules could theoretically be deployed, but that would not represent the project's documented operating mode (AI-driven request classification and specialized responders for injection, uploads, and shell sessions). Publishing a numeric UHQS without the AI stack would mislead CTI readers comparing against fully-featured deployments.
What analysts should do instead¶
- Treat this entry as a catalog gap note, not a failing grade.
- If you operate lophiid with OpenRouter/VT keys and isolated agents, author a hermetic inventory + Web-API HTTP TPS (see the HellPot HTTP lab pattern), then re-run
uhbs-lablocally once your stack matches production intent. - For OWA-style credential sinks without AI, see graded proof for owa-honeypot in the same batch.
Protocol survey¶
| Surface | UHBS plugin? | Graded? | Notes |
|---|---|---|---|
| HTTP (agent) | yes (http) |
no | Skip — AI/OpenRouter dependency |
Named product is survey documentation only — not a UHBS endorsement.