krain-sec

What's in the box

Shiny bait. Quiet real site.

Four decoy surfaces, planted secrets, crawler lures, and tarpits — built to look more interesting than your real services. The Aetheris SOC console plays the role of a real admin dashboard and embeds a WebRTC probe that may surface client addresses beyond some VPN egress IPs. Scroll the features; the wheel tracks the active decoy.

Operator manuals /docs/ with plant-IDs
Auth downloads after decoy login
Corp identity: CORP-PROD-* banners & MOTD
Soft-fail decoys — HTTP bait keeps running

Open the feature reference

Drag / scroll wheel · or scroll the cards

01 / 10

SOC console

Aetheris presents as a real internal admin / SOC dashboard — login screen, JWT session, ops-looking UI — so curious humans and credential stuffers treat it like the prize, not a decoy.

Built to feel like a live admin console operators would actually use, not a thin login stub.
Before authentication, the login page embeds a WebRTC probe that attempts STUN/ICE candidate discovery.
That path can reveal network addresses that bypass some VPN / proxy setups, and may expose a closer-to-real client IP when the browser cooperates.
Attribution is opportunistic supporting signal — not guaranteed against every VPN, browser hardening, or network policy.

:8080

Aetheris · CORP-PROD-SRV05

admin UI · WebRTC probe

WeeklyFinanceOpsAlertsAuth

Open tickets

Sev-1

Operators

02 / 10

SSH decoy

A fake interactive shell that looks like a production jump box: banner, MOTD, shell history, and “emergency” files in a virtual home directory.

Move real admin SSH off :22 before publishing bait.
Planted paths and history push curious operators deeper into the decoy story.

:22

admin@CORP-PROD-SRV05:~$

03 / 10

MySQL decoy

Speaks a real-looking MySQL handshake so scanners fingerprint a database, then always returns Access denied.

Keeps automated DB scanners occupied on the familiar :3306 surface.
No real schemas, credentials, or data paths behind it.

:3306

→ MySQL handshake OK

ERROR 1045 (28000): Access denied for user 'root'@'…'

always. every time.

04 / 10

Grafana decoy

Grafana-like UI with a healthy /api/health response so it looks like a live observability stack — login never succeeds.

Familiar dashboards and API shape attract scanners hunting misconfigured Grafana.
Auth stays fake; nothing connects to real metrics or production systems.

:3000

/api/health

200 OK

05 / 10

Honeytokens & canaries

Break-glass credentials, fake AWS keys, SSH keys, and PDF runbooks that deepen the story and light up when someone follows the bait.

Planted secrets look operational enough to be worth stealing.
Touching a canary is supporting evidence that the diversion worked.

aws_key.txtgrabbed

break-glass.pdfplanted

/t/canary.gifgrabbed

06 / 10

Crawler lures

robots.txt and sitemap.xml that advertise “forbidden” paths scanners love to hit, then feed them into decoy surfaces.

Bait URLs in robots, sitemaps, HTML comments, and frontend metadata.
Crawlers and directory busters follow the map into rabbit holes.

# robots.txt

Disallow: /admin/backup/

Disallow: /internal/keys/

sitemap.xml → “forbidden” paths scanners chase

07 / 10

Tarpits

Waste automated scanning time with a fake log archive, gzip bomb, infinite Apache-style indexes, request lag, and per-IP rate limits.

1–9s artificial lag and rate limits slow noisy tooling.
Designed for bots and scanners — not to “hack back” at the source.

Index of /backup/

dump-0001.tar.gz …… 20M

dump-0002.tar.gz …… 21M

dump-0003.tar.gz …… 22M

dump-0004.tar.gz …… 23M

dump-0005.tar.gz …… 24M

dump-0006.tar.gz …… 25M

dump-0007.tar.gz …… 26M

dump-0008.tar.gz …… 27M

dump-0009.tar.gz …… 28M

dump-0010.tar.gz …… 29M

dump-0011.tar.gz …… 30M

dump-0012.tar.gz …… 31M

gzip bomb · lag 1–9sstall

08 / 10

Activity visibility

Local records of which decoys drew attention — HTTP, SSH, tokens, WebRTC probes, MySQL, Grafana — so you can see how probes moved through the bait.

Bounded, local retention (seven days by default).
Supporting evidence for diversion — not a SIEM replacement.

sshauth fail root@…

httpGET /downloads/aws

tokenbeacon /t/*.gif

local activity · 7-day retention

09 / 10

Sidecar-safe

Runs beside the real site in an isolated Docker network with a read-only filesystem and soft-fail if a decoy port cannot bind.

Internal network cannot reach your DB or LAN.
Compose isolation, caps, and soft-fail keep the real site’s uptime first.

soft-fail

read-only FS

no outbound

caps dropped

10 / 10

Tiny footprint

~23MB Alpine image with a static Go binary — no real DB or Grafana stack — capped so it cannot starve the site.

Default resource cap: 256MB RAM / 0.5 CPU.
Small enough for a solo VPS beside production.

~23MB

256MB · 0.5

SOC console

Aetheris presents as a real internal admin / SOC dashboard — login screen, JWT session, ops-looking UI — so curious humans and credential stuffers treat it like the prize, not a decoy.

Built to feel like a live admin console operators would actually use, not a thin login stub.
Before authentication, the login page embeds a WebRTC probe that attempts STUN/ICE candidate discovery.
That path can reveal network addresses that bypass some VPN / proxy setups, and may expose a closer-to-real client IP when the browser cooperates.
Attribution is opportunistic supporting signal — not guaranteed against every VPN, browser hardening, or network policy.

:8080

Aetheris · CORP-PROD-SRV05

admin UI · WebRTC probe

WeeklyFinanceOpsAlertsAuth

Open tickets

Sev-1

Operators

SSH decoy

A fake interactive shell that looks like a production jump box: banner, MOTD, shell history, and “emergency” files in a virtual home directory.

Move real admin SSH off :22 before publishing bait.
Planted paths and history push curious operators deeper into the decoy story.

:22

admin@CORP-PROD-SRV05:~$

Honeytokens & canaries

Break-glass credentials, fake AWS keys, SSH keys, and PDF runbooks that deepen the story and light up when someone follows the bait.

Planted secrets look operational enough to be worth stealing.
Touching a canary is supporting evidence that the diversion worked.

aws_key.txtgrabbed

break-glass.pdfplanted

/t/canary.gifgrabbed

Activity visibility

Local records of which decoys drew attention — HTTP, SSH, tokens, WebRTC probes, MySQL, Grafana — so you can see how probes moved through the bait.

Bounded, local retention (seven days by default).
Supporting evidence for diversion — not a SIEM replacement.

sshauth fail root@…

httpGET /downloads/aws

tokenbeacon /t/*.gif

local activity · 7-day retention

See all 10 features

After they bite

They find :8080. The maze starts.

A scanner sees a promising internal console, then brings crawlers, directory busters, brute-forcers, protocol clients, and download tools. krain-sec gives each tool a believable next step that stays inside the decoy — including a WebRTC probe on the admin login that may surface addresses beyond some VPN egress IPs.

Attacker path

What happens after they bite

One path. They chase the decoy. Your real site stays boring.

01
They scan
Find open bait ports like :8080
02
Hit Aetheris
Looks like a real admin / SOC dashboard
03
WebRTC runs
May reveal IP past some VPNs
04
They dig deeper
Fake logins, files, SSH, MySQL, Grafana
05
Stuck in bait
Rabbit holes · you see the activity

Meanwhile :80 / :443 stay the real website — customers never enter this path.

Tool by tool

Every probe gets more fiction.

Responses slow and misdirect tools without touching the attacker or connecting them to production.

Nmap / Masscan

Map open ports and fingerprint services.

Standard ports answer with believable SSH, MySQL, Grafana, and HTTP surfaces, producing a convincing but false service map.

False attack surface

Crawlers / headless bots

Extract links, forms, documents, and hidden paths.

robots.txt, sitemap.xml, cross-linked decoy pages, manuals, and planted URLs lead the crawler deeper into fake content.

More decoy paths

Gobuster / DirBuster / ffuf

Enumerate directories and files at high speed.

Plausible forbidden paths, endless Apache-style indexes, 1–9 second request lag, and per-IP 429 limits stretch the scan.

Enumeration slowed

Hydra / credential stuffers

Brute-force web and SSH credentials.

Authentication is isolated from every real account. Rate limits slow repeated attempts, while bait credentials only unlock more decoy content.

No real identity exposed

Nikto / Nuclei / web scanners

Probe common admin, backup, health, and misconfiguration paths.

Grafana-like health responses, fake admin routes, backup trees, downloads, and consistent corporate naming keep checks focused on fiction.

Checks consume bait

curl / wget / archive grabbers

Pull logs, backups, keys, and large archives.

Fake downloads, canary files, infinite indexes, and the compressed tarpit on the fake log archive punish greedy recursive fetching.

Downloads become dead ends

SSH / MySQL / Grafana clients

Connect directly after service discovery.

SSH opens a controlled fake shell, MySQL performs a realistic handshake then denies access, and Grafana appears healthy but never reaches a real stack.

Pivot stays fake

Hands-on attacker

Read history, inspect files, and follow promising credentials.

Consistent hostnames, runbooks, emergency files, planted keys, and canary PDFs form believable chains between decoy surfaces.

Deeper rabbit holes

This is controlled deception, not retaliation. Keep rate limits, resource caps, isolation, and real-service hardening enabled.

Read the safe luring guide

Explore tool responses in docs

Same-VPS deploy tip

Bait owns the classic ports.

When krain-sec shares the production VPS, move real SSH and MySQL elsewhere first. Put the pots on :22 and :3306 so scanners find decoys on the ports they always try. A separate honeypot VPS does not require production port changes.

Before

:22Real SSH

:3306Real MySQL

After

:22Fake SSH

:3306Fake MySQL

:2222Real SSH

:3307Real MySQL

Live fingerprint

What nmap actually sees.

Real -sV run against a deployed instance. Classic bait ports answer with believable banners — OpenSSH, MySQL, Grafana HTML, Aetheris login — while the real site stays off this map.

nmap -sV · real capture4 open

$ nmap -sV 192.168.12.5

Service fingerprints

22/tcpSSH banner

SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.10

3000/tcpHTTP body

<title>Grafana</title> · Golang net/http

3306/tcpHandshake

MySQL 8.4.10

8080/tcpHTTP body

Aetheris Security — Sign In · X-Ratelimit-*

Built with

Go1.25+

DockerCompose

Alpine~23MB

Sidecarbeside your site