Kandaro Deception
Decoys for every part of your network.
26 decoy profiles, each one emulating the real ports and services of the system it poses as. Nobody has a reason to touch them, so anything that does is worth reading.
Devices and servers
Infrastructure an intruder expects to find.
Servers, storage, network gear, databases and the systems around them.
- device
Linux server
Ubuntu database and web server
The classic lateral-movement target: SSH, a web admin, MySQL, Redis and MongoDB.
SSH 22HTTP 80HTTPS 443MySQL 3306Redis 6379+3 - device
Windows file server
Windows file server
Shares, RDP, SQL Server and IIS: exactly what ransomware operators go looking for.
SMB 445NetBIOS 139RPC 135RDP 3389SQL Server 1433+4 - device
NAS
NAS and backup storage
Backups are the first thing an intruder wants to find, and destroy.
HTTP 5000HTTP 80HTTPS admin 5001SSH 22FTP 21+3 - device
Network printer
Office network printer
Blends into any office network. Nobody logs into a printer by accident.
HTTP 80JetDirect 9100TFTP 69/udpLPD 515IPP 631+3 - device
Managed switch
Managed switch or router
Network gear with Telnet, SSH, a Basic Auth web admin and SNMP.
Telnet 23SSH 22HTTP 80SNMP 161/udpNTP 123/udp - device
FortiGate firewall
Fortinet FortiGate firewall
A FortiGate management page that catches login attempts and known exploit probes.
HTTPS admin 443HTTP admin 80SSH 22Telnet 23SNMP 161/udp - device
IP camera
IP camera (BusyBox)
A favourite of botnets and curious insiders: web login, RTSP video and Telnet.
HTTP 80RTSP 554Telnet 23Camera SDK 8000SIP 5060/udp - device
Redis
Redis cache server
A Redis server on its usual port, plus SSH. Catches scanners looking for open caches.
SSH 22Redis 6379 - device
Elasticsearch
Elasticsearch cluster
A search cluster that looks full of data. Catches index listing and credential guessing.
SSH 22Elasticsearch 9200ES transport 9300 - device
PostgreSQL
PostgreSQL database server
A database server on its usual port, plus SSH. Catches scans and password guessing.
SSH 22PostgreSQL 5432 - device
Docker daemon
Docker host with an open remote API
An open Docker API, the quickest way to take over a host. Every request is recorded.
SSH 22Docker API 2375 - device
Active Directory DC
Active Directory domain controller
The ports of a domain controller. Catches scans and connections to LDAP, Kerberos and SMB.
LDAP 389LDAPS 636Kerberos 88/udpSMB 445RPC 135+1 - device
SQL Server
Microsoft SQL Server
A SQL Server on its usual ports, plus SSH. Catches database scans and connection attempts.
SSH 22SQL Server 1433SQL Browser 1434/udp - device
VMware ESXi
VMware ESXi hypervisor
An ESXi host login. Ransomware groups go after hypervisors to encrypt every VM at once.
ESXi web client 443HTTP 80VMware auth 902 - device
MongoDB
MongoDB database server
A MongoDB server that serves endless fake documents to anyone pulling data.
SSH 22MongoDB 27017
Applications
The tools that hold everyone’s keys.
Identity, secrets, CI/CD, automation and AI: each one stores credentials for other systems.
- app
AI agent server
LLM and AI agent server
Ollama, an OpenAI-compatible API, an MCP tool server and a vector DB. Bait for AI-powered attackers.
SSH 22Ollama 11434OpenAI API 8000MCP 3000Agent console 8080+3 - app
Integration platform
Message bus and integration hub
RabbitMQ, Kafka Connect and Node-RED: where the credentials of every system meet.
SSH 22AMQP 5672RabbitMQ admin 15672Kafka 9092Kafka Connect 8083+1 - app
n8n automation
n8n workflow automation
Workflow automation full of API keys, plus its Postgres database.
SSH 22n8n 5678PostgreSQL 5432 - app
Keycloak IAM
Keycloak identity server
A fake single sign-on server. Whoever controls it controls every account.
SSH 22Keycloak 8080 - app
HashiCorp Vault
HashiCorp Vault secrets manager
A fake secrets manager. Every attempt to read a secret is an alert.
SSH 22Vault 8200 - app
JupyterLab
JupyterLab notebook server
A notebook server, where data scientists keep data, keys and models.
SSH 22JupyterLab 8888 - app
Jenkins CI
Jenkins build server
A build server with credentials for every deploy target. Catches script console and credential access.
SSH 22Jenkins 8080 - app
Grafana
Grafana dashboards
A monitoring server whose data sources hold database passwords.
SSH 22Grafana 3000 - app
Kubernetes API
Kubernetes control plane
A Kubernetes API server. Catches secret listing, pod exec and cluster mapping.
SSH 22Kubernetes API 6443 - app
GitLab
GitLab server
A source-code server with CI secrets. Catches logins, project listing and CI variable access.
SSH 22GitLab 80 - app
Argo CD
Argo CD GitOps server
A GitOps server with credentials for your clusters and Git repos.
SSH 22Argo CD 8080
Put a decoy on your network today.
Start a 14-day trial of Kandaro Deception. Your first decoy is running in about a minute.
Card required · cancel before day 14 and pay nothing