qeeqbox/honeypots¶
Status: Informative · evaluation proof
Upstream: https://github.com/qeeqbox/honeypots · GitHub last push 2025-12-03
Runtime: qeeqbox-honeypots:uhbs-lab (pip install in Python 3.11)
What this decoy is¶
Multi-protocol honeypot framework; UHBS published selected overlapping protocol grades.
Protocol survey (graded)¶
| Surface | UHBS plugin? | Graded? | Quick | Full |
|---|---|---|---|---|
| ssh | yes | yes | 59.88 / D | 59.68 / D |
| http | yes | yes | 45.84 / F | 45.73 / F |
| ftp | yes | yes | 42.71 / F | 40.31 / F |
| telnet | yes | yes | 29.88 / F | 29.77 / F |
| smtp | yes | yes | 30.9 / F | 30.78 / F |
| pop3 | yes | yes | 31.06 / F | 30.94 / F |
| mysql | yes | yes | 34.38 / F | 34.27 / F |
| postgres | yes | yes | 34.38 / F | 34.27 / F |
| redis | yes | yes | 34.61 / F | 34.5 / F |
| vnc | yes | yes | 32.92 / F | 32.81 / F |
Skipped in this proof¶
| dhcp, dns, httpproxy, https, httpsproxy, imap, ipp, irc, ldap, memcache, mssql, oracle, pjl, socks5, elastic, snmp, ntp, sip, smb, rdp | — | skipped | — | — |
* UHBS has plugins for snmp/ntp/sip/smb/rdp/elastic-as-http but they were not included in this lab batch (UDP/TLS/heavy deps deferred). elastic can be graded as http in a follow-up.
For CTI analysts¶
- Protocol-by-protocol results vary widely — use per-protocol hubs, not a single composite “qeeqbox score”.
Primary signals you can expect (when logging is wired): Per-protocol auth/banner telemetry depending on enabled services.
For blue teams / detection engineering¶
- Enable only needed protocols; each listener expands attack surface on the decoy host.
- Compare UHBS plugin coverage vs qeeqbox capabilities — unsupported protocols were not graded.
Trust & limitations¶
- This page is evaluation proof under UHBS 4.2.2 — not a certification or vendor ranking.
- Prefer full/ artifacts over quick/ for operational decisions.
- Re-run via TUTORIAL.md; environment notes in METHODOLOGY.md.
- How to read modules: READING-UHQS.md