Exposed to the internet — this is a deliberately open demo host. Every port below is reachable by anyone who scans its IP right now. No login, no MFA, no audit. It exists to show the attack surface Veil removes.

VEIL live demo getveil.eu →
Live · scan it yourself

This host is wide open to the internet.

You reached it by just typing a name. So can any scanner, bot, or attacker on earth — no identity required. Every service running here answers the public internet directly. That reachability is the first move in almost every breach.

host exposed.getveil.eu · 64.227.70.83 · try it: nmap -sV exposed.getveil.eu
The attack surface

What's open on this host — right now

These are real, listening services on this exact machine. Anyone can connect to them; several need no credentials at all.

22open
ssh
Brute-force and credential-stuffing target, 24/7.
80open
http
This console — served to anyone, no auth in front of it.
5432open
postgresql
A database reachable from the open internet. It should never be.
6379open
redis
Unauthenticated by default — a one-command data dump.
11434open
ollama · LLM API
Model theft, free GPU abuse, RCE on unpatched builds.
attacker@anywhere ~ %
$ nmap -sV exposed.getveil.eu
Starting Nmap … scanning 64.227.70.83

PORT      STATE  SERVICE     VERSION
22/tcp    open   ssh         OpenSSH 9.6p1 Ubuntu
80/tcp    open   http        ACME Ops console
5432/tcp  open   postgresql  PostgreSQL 16
6379/tcp  open   redis       Redis 7.0.15
11434/tcp open   http        Ollama LLM API

# 5 open ports. Full attack surface, indexed in seconds.

The data behind these ports is planted demo data — nothing real is at risk here. The exposure, though, is completely real.

The whole point

The identical stack — cloaked by Veil.

Same app, same database, same model server, running on a second host. The only difference: Veil. A scanner sweeping the internet finds nothing to connect to.

● this host — exposed

5

open ports · reachable by anyone

22 ssh open
80 http open
5432 pg open
6379 redis open
11434 ai open

● cloaked.getveil.eu — dark

0

reachable services · nothing to attack

22 ssh closed
80 http closed
5432 pg closed
6379 redis closed
11434 ai closed

The cloaked host still works perfectly — but only for a verified identity coming in over Veil's private overlay. From the public internet it simply doesn't answer. There's no port to find, no login to brute-force, no version to fingerprint.

What Veil does

It removes reachability — before authentication ever matters.

Nothing to scan

Your services go dark on the public internet. Mass scanners index open ports within hours — you're simply not on the list.

Identity, not IP

Access is granted to a verified, MFA-checked identity — not to anyone who can route a packet to a port.

Every reach audited

Who reached what, when, from where — logged. Blind public exposure becomes accountable, revocable access.

Dark by default

Then Veil pulls it into the dark.

Same services, no open ports — reachable only by a verified identity.

Take your servers off the map.

Cloak the services you can't afford to leave exposed — SSH, databases, dashboards, model APIs. Reachable only by a verified identity. One command, under 20 minutes.