What lures are
A lure is a deliberately exposed decoy service. H1VE ships dozens of product-faithful images—VPN portals, web stacks, SCADA/PLC interfaces, Grafana, GitHub mimics, and research surfaces such as Next.js CVE lures for zero-day workflows.
Supported lure categories
- VPN / edge — Fortinet, Cisco AnyConnect, Palo Alto GlobalProtect, Citrix, Check Point, Ivanti, F5 BIG-IP, generic gateway
- Web / app — Apache, Nginx, IIS, Tomcat, WordPress, router admin, Website Clone
- Network services — SSH, FTP
- OT / ICS — RapidSCADA, OpenSCADA, Node-RED, Modbus/S7/OpenPLC, MQTT, CoAP
- Data & dev — InfluxDB, Grafana, TimescaleDB, GitHub
Deploying a lure
- Open Lure Center → Create Lure
- Choose a realistic name and lure type
- Configure DNS (recommended for production-like reachability)
- Optional: Public Services & Ports for multi-service personas
- Create, then Start if not auto-started
DNS, SSL, and branding
DNS integrates via Technitium (API token or user/pass + zone) or Azure DNS (service principal + subscription + zone). Subdomains must be lowercase alphanumeric with hyphens. SSL certificates generate through the platform's ACME integration when enabled.
Branding customization adjusts login pages, logos, and copy for VPN/web personas. Website Clone accepts a seed URL—the mimic crawler reproduces assets for higher fidelity.
Sandbox isolation
Each lure runs in an isolated container with constrained capabilities. Privileged images (e.g., OpenPLC) are documented in Lure Center with build-time warnings. Never co-locate lure workloads with production data planes on the same kernel without cgroup/namespace isolation.
DNS prerequisite