​
OneFirewall DeceptionGrid™

​
Overview

DeceptionGrid™ is OneFirewall’s global honeynet platform — a distributed network of high-fidelity honeypots deployed across strategically chosen geolocations. Built to attract, monitor, and study real-world cyber adversaries, DeceptionGrid™ transforms attacker activity into actionable threat intelligence.

Each node in the DeceptionGrid™ network is designed to simulate a believable digital environment using a rich set of decoy services. By observing threat actors interact with these services, OneFirewall extracts telemetry, attack patterns, and behavioral indicators that enrich its Threat Intelligence Data Lake.

DeceptionGrid™ serves as an early-warning radar for emerging threats and offers invaluable insight into attacker tactics, techniques, and procedures (TTPs).

Catch the adversary before they reach your perimeter.

​
Services Deployed per Honeypot Node

Each DeceptionGrid™ node simulates a wide range of services, categorized to attract diverse adversaries:

​
🔒 Network & Remote Access

  • SSH (Port 22) – Secure shell for credential brute-force and key abuse.
  • Telnet (Port 23) – Simulates legacy devices and insecure admin access.
  • RDP (Port 3389) – Windows remote desktop environment.
  • OpenVPN/IPsec (Port 1194/500) – Corporate VPN gateway emulation.

​
🌐 Web & API Services

  • HTTP/HTTPS (Port 80/443) – Fake websites, admin panels, and CMS.
  • RESTful APIs (Custom ports) – Mimicking microservices or internal APIs.
  • WebSocket endpoints – For real-time protocol interaction analysis.

​
🧪 IoT & OT Protocols

  • Modbus (Port 502) – Industrial control simulation.
  • MQTT (Port 1883) – Internet of Things (IoT) message broker.
  • UPnP/SSDP – Emulating smart home broadcast traffic.
  • BACnet (Port 47808) – Building automation system protocol.
  • Zigbee (Simulated stack) – Emulating wireless sensor activity.

​
💾 File & Data Access

  • FTP/SFTP (Port 21/22) – Insecure file transfer protocols.
  • SMB/CIFS (Port 445) – Windows file sharing with weak credentials.
  • NFS (Port 2049) – Unix/Linux network file system.
  • ElasticSearch (Port 9200) – Simulates open data analytics nodes.

​
🧠 Databases

  • MySQL (Port 3306)
  • PostgreSQL (Port 5432)
  • MongoDB (Port 27017)
  • Redis (Port 6379)
  • Cassandra (Port 9042)

These are configured with known vulnerabilities or weak configurations.

​
☁️ DevOps & Cloud Services

  • Docker Daemon API (Port 2375) – Exposed container runtime.
  • Kubernetes API/Kubelet (Port 10250) – Mimicking open clusters.
  • Jenkins (Port 8080) – Continuous integration tool interface.
  • GitLab CI (Port 8929) – Simulates self-hosted pipelines.

​
📨 Email & Messaging

  • SMTP (Port 25)
  • IMAP (Port 143) / POP3 (Port 110) – Emulating enterprise mailboxes.

​
🔗 Authentication & Directory Services

  • LDAP/LDAPS (Port 389/636) – Enterprise directory services.
  • Kerberos (Port 88) – Windows domain controller simulation.
  • OAuth/OpenID Connect endpoints – Simulating federated auth flows.

​
📞 VoIP & Legacy Communication

  • SIP (Port 5060) – VoIP endpoint attracting toll fraud attempts.
  • XMPP/IRC – Emulating chat/C2 environments.

​
🎭 Application & Custom Decoys

  • Vulnerable Web Apps – DVWA, Juice Shop, fake ERP/CRM systems.
  • Fake Admin Portals – SCADA dashboards, CMS panels.
  • Geo-localized Interfaces – Banking portals or ISP panels specific to node region.

​
Deployment Architecture

Each DeceptionGrid™ node is:

  • Isolated and sandboxed for controlled observation.
  • Geographically distributed to maximize visibility across regions.
  • Tuned for low-interaction and high-interaction deception, based on the node’s risk tolerance and observational role.
  • Instrumented for full telemetry, including session recording, packet capture, and real-time alerting.

​
How It Works

  1. Lure & Engage: DeceptionGrid™ nodes respond to global scans and targeted probing with realistic service banners and behaviors.
  2. Record & Analyze: All activity is logged, enriched, and correlated in real time.
  3. Extract Intelligence: Attacker behavior is converted into IOCs, TTPs, and threat actor fingerprints.
  4. Feed Defense: Threat data flows into OneFirewall’s Threat Intelligence sharing platform for broader ecosystem protection.

​
Product Name

OneFirewall DeceptionGrid™ – The Global Honeynet

For integration or research partnerships, contact the OneFirewall team.