Included in Professional Plan

Protocol Honeypots

Fake database and service endpoints that look real to attackers. When they try to connect or authenticate, you capture everything — credentials, tools, and source information.

Supported Protocols

All protocols are included in the same tier. No upsells for specific databases.

PG
PostgreSQL
Port 5432

Captures user, database, application name, and startup parameters.

MY
MySQL
Port 3306

Full handshake capture including auth credentials and client capabilities.

RD
Redis
Port 6379

Captures AUTH passwords and all commands attempted.

MG
MongoDB
Port 27017

Wire protocol parsing for auth attempts and database enumeration.

SSH
SSH
Port 22

Banner exchange, client fingerprinting, and auth attempts.

LD
LDAP
Port 389/636

Bind DN and credentials, search queries, Active Directory recon.

SM
SMTP
Port 25/587

EHLO, AUTH credentials, and envelope information.

RQ
RabbitMQ
Port 5672

AMQP handshake, vhost access, and credentials.

More protocols coming: Kafka, Elasticsearch, SMB, FTP, and custom TCP services

How It Works

1

Create Honeypot

Select a protocol (PostgreSQL, MySQL, etc.) and we provision a unique hostname.

2

Plant the Reference

Add the fake connection string to config files, documentation, or code comments.

3

Attacker Finds It

When they scan or try to use the credentials, our honeypot responds like a real server.

4

Instant Alert

We capture their IP, credentials used, client tools, and timing — and alert you instantly.

Deployment Strategies

In Code & Config

Add fake database connection strings to your codebase. If someone clones your repo or steals your config, you'll know when they try to connect.

# .env.backup (never used)
DB_HOST=pg-backup.tripwire.acme.com
DB_USER=backup_admin
DB_PASS=Tr1pw1r3_2024!

In Documentation

Add references to "legacy" or "backup" databases in internal wikis. Attackers love finding documented shortcuts.

## Legacy Database (read-only)
For historical data before 2020, connect to:
redis-legacy.internal:6379
AUTH: legacy_reader_2019

Network Decoys

Create DNS entries for plausible services. Anyone scanning your network or resolving internal hostnames will trip the wire.

# Internal DNS zone
mongodb-analytics.corp → honeypot
ldap-backup.corp → honeypot
smtp-relay.corp → honeypot

Password Managers

Add honeypot credentials to your team's password manager. If someone exports or steals credentials, you'll catch them.

Production DB (Legacy)
Host: mysql-prod-legacy.internal
User: app_service
Pass: ••••••••••••

Catch Attackers Probing Your Infrastructure

Deploy protocol honeypots in minutes. All protocols included at £49/month.