Engage commodity scanners with believable decoys
Your real website should look uninteresting to scanners. krain-sec parks a louder, juicier fake beside it — fake SSH, fake MySQL, fake Grafana, and a fake SOC console — giving commodity scanners and curious intruders believable dead ends to investigate.
Real · :80/:443
Stays boring
Bait · decoys
Looks like the prize
Ubuntu 22.04.4 LTS CORP-PROD-SRV05.internal
user=admin ip=185.220.101.42 path=/login
user=admin ip=45.33.32.156 banner=CORP-PROD-SRV05.internal
cmd="cat Documents/break-glass.txt"
ip=91.92.242.18 result=access_denied
path=/backup/ index=infinite
Alpine image
~23MB
static Go binary
Resource cap
256MB / 0.5
RAM / CPU
Decoy surfaces
4
SSH · MySQL · Grafana · Console
License
AGPL-3.0
open source
The job
Scanners probe whatever looks open, juicy, or misconfigured. When familiar ports present convincing decoys, opportunistic probes can spend their time and noise there instead of immediately reaching real admin services.
Boxes keep getting hit by everything from script kiddies to sharper scanners. Full enterprise deception stacks are expensive and heavy to run. krain-sec is something small teams and solo ops can actually deploy: one container, low RAM, make prod, done.
Customers
normal traffic
Scanners & bots
probing the box
Your VPS
traffic splits here
Real website
80 / 443
Honeypot
22 · 3306 · 3000 · 8080
Built for diversion.
krain-sec is designed to consume scanner time with rabbit holes, decoy ports, planted secrets, and dead ends while your real site on 80/443 stays boring. Customers reach the real site. Commodity scanners and curious intruders encounter the bait.
Only on servers you own. Not “hack back” — controlled deception for engaging opportunistic probes without touching the source.
Engage commodity scanners and curious intruders with believable decoy services while your real website stays on ports 80 and 443.
Real site
:80 / :443
krain-sec bait
decoy:22 · :3306 · :3000 · :8080
Who this is for
Small teams & solo operators
primaryPrimary audience. You run a real site on a VPS and want scanners chasing convincing decoys instead of your app. One small container beside it. No SOC required.
Blue teams / SOC labs
Decoy asset that lights up when scanners or humans poke it — without standing up a fat SIEM.
Detection engineers
Use decoy interactions as supporting signals for rules and pipelines while diversion remains the primary job.
Researchers & students
Study deception and light attribution (WebRTC probe, beacons) without touching a real IdP.
Homelab / purple team
Safe attacker playground on an isolated VLAN or throwaway VPS.
Who it attracts
Optimized for noisy, high-volume, and curious adversaries — not a full APT jail.
Internet scanners
Probing familiar ports such as SSH, MySQL, Grafana, and HTTP across public IP ranges.
Crawlers & bots
Extracting bait URLs from robots.txt, sitemaps, HTML comments, and frontend metadata, then following them into decoy paths.
Credential stuffers
Banging on the fake Aetheris console login.
Curious humans
Downloading “break-glass” packs, runbooks, and planted keys.
Hands-on attackers
Following planted credentials, fake SSH history, emergency files, and canary PDFs deeper into believable rabbit holes.
How it works
Pick a traffic path. Normal visitors stay on the real site. Scanners and curious intruders get pulled into decoys instead.
Scenario · normal visitor
Internet
customers
your VPS
standard ports become bait
:22:3306:3000:8080admin services use moved ports
:80 / :443:2222:3307:3001Traffic path
They only need the real website. Nothing juicy, nothing to chase.
Visitor opens your site
Browser hits the public URL on :80 / :443 like any normal website.
Traffic stays on the real app
HTTP/HTTPS goes to your real service. No decoy ports involved.
They never see the bait
Fake SSH, MySQL, Grafana, and the SOC console stay off this path. Customers just use the product.
Product tour
Explore every decoy surface and attacker path.
Deployment
Run krain-sec beside production for immediate scanner diversion, or isolate it on a dedicated VPS. Both keep the real website serving customers normally.
Shared host
Run krain-sec beside your real website or service. The honeypot takes the standard bait ports, while real administrative services move to alternate ports. Your public website stays on 80/443.
Best when you want scanners hitting the production IP to discover the decoys immediately.
Dedicated decoy
Run krain-sec on another server with its own public IP and, preferably, a believable subdomain. Your production ports and services do not need to move.
Best for stronger isolation, simpler production networking, and a larger decoy surface.
Safety
Deploy
git clone https://github.com/h3ma209/krain-sec.git
cd krain-sec
cp .env.example .env # edit HONEYTOKEN_BASE_URL when you go public
make prod # build + start the decoysFrom clone → bait online
(.env · HONEYTOKEN_BASE_URL)
make prodLive fingerprint
Real -sV run against a deployed instance. Classic bait ports answer with believable banners — OpenSSH, MySQL, Grafana HTML, Aetheris login — while the real site stays off this map.
$ nmap -sV 192.168.12.5
Service fingerprints
SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.10
<title>Grafana</title> · Golang net/http
MySQL 8.4.10
Aetheris Security — Sign In · X-Ratelimit-*
Simulated activity demo
Decoy activity shows which fake doors, planted secrets, and dead ends drew interaction. The preview is simulated; deployed instances record their own local activity.
user=admin ip=185.220.101.42 path=/login
user=admin ip=45.33.32.156 banner=CORP-PROD-SRV05.internal
cmd="cat Documents/break-glass.txt"
ip=91.92.242.18 result=access_denied
path=/backup/ index=infinite
FAQ
No. krain-sec gives commodity scanners believable decoys to investigate; it does not replace patching, backups, TLS, or locking down your real app. Treat it as bait that makes the real site look boring — not a shield.
Anyone whose VPS website keeps getting poked and wants the interesting-looking doors to be fake. Built for small teams and solo operators — also useful in labs for blue teams, detection engineers, researchers, and purple-team homelabs. Not a real SSO, SIEM, or production auth stack.
Goal is controlled diversion, not only collecting alerts. krain-sec gives commodity scanners shinier fake doors — rabbit holes, decoy ports, planted secrets, and tarpits — that can hold opportunistic probes inside bait. Customers stay on 80/443 while decoy traffic remains isolated.
Only on infrastructure you own or explicitly control. Not “hack back.” Bait passwords are fake — never reuse them for real access. krain-sec is licensed under AGPL-3.0.
Yes. krain-sec keeps local activity records showing HTTP, SSH, honeytoken, WebRTC, MySQL, and Grafana interactions. They help you understand which bait worked, are retained for seven days by default, and never leave your server automatically.
Designed not to. Static Go on Alpine (~23MB), hard-capped at 256MB RAM / 0.5 CPU, internal network, read-only filesystem. Soft-fail: if SSH/MySQL/Grafana can’t bind, the HTTP bait keeps running.
Ready to deploy
Review the safety checklist, clone the repository, and start the isolated decoys with Docker Compose.