cedwardsmedia/faketp repository overview

⁠FakeTP

FakeTP is a tiny fake FTP honeypot/troll server packaged as a Docker container.

It pretends to be an exposed anonymous FTP server, lists extremely tempting fake files, and then wastes the time of unauthorized clients that try to download them. One real file, Emotional_Damage.jpg, is included as the punchline. Everything else is fake.

This project is inspired by tools like EndleSSH, but for FTP.

⁠What it does

• Listens as a basic anonymous FTP server
• Accepts essentially any username/password combination
• Shows a fake directory listing with bait filenames and convincing file sizes
• Supports basic FTP commands used by clients like FileZilla and Cyberduck
• Sends a fast burst of fake data, slows to a painful trickle, then aborts fake downloads
• Includes clear in-band notices that the fake files are not real
• Provides one legitimate downloadable file: emotional_damage.jpg

⁠What it does not do

• It does not host real leaked, stolen, copyrighted, or confidential files
• It does not provide a real FTP storage service
• It does not accept uploads
• It is not meant to replace a proper security honeypot platform

⁠Docker usage

Pull and run:

docker run --rm \
  -p 2121:2121 \
  -p 30000-30010:30000-30010 \
  cedwardsmedia/faketp

Then connect with an FTP client:

Host: 127.0.0.1
Port: 2121
User: anonymous
Password: anything, or blank

⁠Why the extra ports?

FTP uses two connections:

• a control connection for commands and replies
• a data connection for directory listings and file transfers

FakeTP listens on port 2121 for the FTP control connection and uses passive data ports 30000-30010 for listings and downloads. Those passive ports must be published when running in Docker, or FTP clients may connect but fail when listing or downloading files.

⁠Local build

docker build -t faketp .

docker run --rm \
  -p 2121:2121 \
  -p 30000-30010:30000-30010 \
  faketp

⁠Notes

For local testing, 127.0.0.1:2121 is usually fine.

If running this on another machine or across a LAN/WAN, make sure your FTP client can reach both the control port and the passive data port range.

⁠Disclaimer

FakeTP is a toy deception service for wasting the time of bots, scanners, and people poking at services they do not have permission to access. Use it responsibly and only on systems/networks you control.