diff --git a/decnet_web/src/components/MazeNET/Palette.tsx b/decnet_web/src/components/MazeNET/Palette.tsx
index 1d0dd9e0..dc2ff47b 100644
--- a/decnet_web/src/components/MazeNET/Palette.tsx
+++ b/decnet_web/src/components/MazeNET/Palette.tsx
@@ -1,7 +1,7 @@
 import React from 'react';
 import { GitMerge, ShieldAlert, Server, Monitor, Shield, Database, Cpu, Globe,
          Terminal, Lock, Folder, HardDrive, Users, KeyRound,
-         Radio, Zap, Wifi, Circle } from 'lucide-react';
+         Radio, Zap, Wifi, Circle, Mail, Phone, Activity, Box } from 'lucide-react';
 import type { ServiceDef, Archetype, ServiceGroup } from './data';
 import { SERVICE_GROUP_ORDER } from './data';
 import type { PaletteDrag } from './useMazeInteraction';
@@ -12,6 +12,7 @@ const ICON: Record<string, React.ComponentType<{ size?: number; className?: stri
   database: Database, cpu: Cpu, globe: Globe, terminal: Terminal, lock: Lock,
   folder: Folder, 'hard-drive': HardDrive, users: Users, 'key-round': KeyRound,
   radio: Radio, zap: Zap, wifi: Wifi, circle: Circle,
+  mail: Mail, phone: Phone, activity: Activity, box: Box,
 };
 
 function Icon({ name, size = 14, className }: { name: string; size?: number; className?: string }) {
@@ -70,7 +71,7 @@ const Palette: React.FC<Props> = ({ services, archetypes, startPaletteDrag, clas
         {(() => {
           const byGroup = new Map<ServiceGroup, ServiceDef[]>();
           for (const s of services) {
-            const g = (s.group ?? 'Remote Access') as ServiceGroup;
+            const g = (s.group ?? 'Miscellaneous') as ServiceGroup;
             const list = byGroup.get(g) ?? [];
             list.push(s);
             byGroup.set(g, list);
diff --git a/decnet_web/src/components/MazeNET/data.ts b/decnet_web/src/components/MazeNET/data.ts
index 315fe361..ca389266 100644
--- a/decnet_web/src/components/MazeNET/data.ts
+++ b/decnet_web/src/components/MazeNET/data.ts
@@ -21,7 +21,12 @@ export type ServiceGroup =
   | 'File Transfer'
   | 'Directory'
   | 'Databases'
-  | 'IoT / OT';
+  | 'Mail'
+  | 'Communications'
+  | 'IoT / OT'
+  | 'Observability'
+  | 'Containers'
+  | 'Miscellaneous';
 
 // Rendering order for the palette.
 export const SERVICE_GROUP_ORDER: ServiceGroup[] = [
@@ -30,7 +35,12 @@ export const SERVICE_GROUP_ORDER: ServiceGroup[] = [
   'File Transfer',
   'Directory',
   'Databases',
+  'Mail',
+  'Communications',
   'IoT / OT',
+  'Observability',
+  'Containers',
+  'Miscellaneous',
 ];
 
 export const ARCHETYPES: Archetype[] = [
@@ -43,20 +53,46 @@ export const ARCHETYPES: Archetype[] = [
 ];
 
 export const DEFAULT_SERVICES: ServiceDef[] = [
-  { slug: 'ssh',      name: 'SSH',      port: 22,   proto: 'tcp', icon: 'terminal',   risk: 'high', group: 'Remote Access' },
-  { slug: 'rdp',      name: 'RDP',      port: 3389, proto: 'tcp', icon: 'monitor',    risk: 'high', group: 'Remote Access' },
-  { slug: 'http',     name: 'HTTP',     port: 80,   proto: 'tcp', icon: 'globe',      risk: 'med',  group: 'Web' },
-  { slug: 'https',    name: 'HTTPS',    port: 443,  proto: 'tcp', icon: 'lock',       risk: 'med',  group: 'Web' },
-  { slug: 'ftp',      name: 'FTP',      port: 21,   proto: 'tcp', icon: 'folder',     risk: 'high', group: 'File Transfer' },
-  { slug: 'smb',      name: 'SMB',      port: 445,  proto: 'tcp', icon: 'hard-drive', risk: 'high', group: 'File Transfer' },
-  { slug: 'ldap',     name: 'LDAP',     port: 389,  proto: 'tcp', icon: 'users',      risk: 'med',  group: 'Directory' },
-  { slug: 'kerberos', name: 'Kerberos', port: 88,   proto: 'tcp', icon: 'key-round',  risk: 'med',  group: 'Directory' },
-  { slug: 'llmnr',    name: 'LLMNR',    port: 5355, proto: 'udp', icon: 'radio',      risk: 'low',  group: 'Directory' },
-  { slug: 'mysql',    name: 'MySQL',    port: 3306, proto: 'tcp', icon: 'database',   risk: 'high', group: 'Databases' },
-  { slug: 'postgres', name: 'Postgres', port: 5432, proto: 'tcp', icon: 'database',   risk: 'high', group: 'Databases' },
-  { slug: 'redis',    name: 'Redis',    port: 6379, proto: 'tcp', icon: 'zap',        risk: 'med',  group: 'Databases' },
-  { slug: 'mqtt',     name: 'MQTT',     port: 1883, proto: 'tcp', icon: 'wifi',       risk: 'low',  group: 'IoT / OT' },
-  { slug: 'modbus',   name: 'Modbus',   port: 502,  proto: 'tcp', icon: 'cpu',        risk: 'med',  group: 'IoT / OT' },
-  { slug: 'coap',     name: 'CoAP',     port: 5683, proto: 'udp', icon: 'wifi',       risk: 'low',  group: 'IoT / OT' },
+  // Remote Access
+  { slug: 'ssh',         name: 'SSH',         port: 22,    proto: 'tcp', icon: 'terminal',   risk: 'high', group: 'Remote Access' },
+  { slug: 'telnet',      name: 'Telnet',      port: 23,    proto: 'tcp', icon: 'terminal',   risk: 'high', group: 'Remote Access' },
+  { slug: 'rdp',         name: 'RDP',         port: 3389,  proto: 'tcp', icon: 'monitor',    risk: 'high', group: 'Remote Access' },
+  { slug: 'vnc',         name: 'VNC',         port: 5900,  proto: 'tcp', icon: 'monitor',    risk: 'high', group: 'Remote Access' },
+  // Web
+  { slug: 'http',        name: 'HTTP',        port: 80,    proto: 'tcp', icon: 'globe',      risk: 'med',  group: 'Web' },
+  { slug: 'https',       name: 'HTTPS',       port: 443,   proto: 'tcp', icon: 'lock',       risk: 'med',  group: 'Web' },
+  // File Transfer
+  { slug: 'ftp',         name: 'FTP',         port: 21,    proto: 'tcp', icon: 'folder',     risk: 'high', group: 'File Transfer' },
+  { slug: 'tftp',        name: 'TFTP',        port: 69,    proto: 'udp', icon: 'folder',     risk: 'high', group: 'File Transfer' },
+  { slug: 'smb',         name: 'SMB',         port: 445,   proto: 'tcp', icon: 'hard-drive', risk: 'high', group: 'File Transfer' },
+  // Directory
+  { slug: 'ldap',        name: 'LDAP',        port: 389,   proto: 'tcp', icon: 'users',      risk: 'med',  group: 'Directory' },
+  { slug: 'kerberos',    name: 'Kerberos',    port: 88,    proto: 'tcp', icon: 'key-round',  risk: 'med',  group: 'Directory' },
+  { slug: 'llmnr',       name: 'LLMNR',       port: 5355,  proto: 'udp', icon: 'radio',      risk: 'low',  group: 'Directory' },
+  // Databases
+  { slug: 'mysql',       name: 'MySQL',       port: 3306,  proto: 'tcp', icon: 'database',   risk: 'high', group: 'Databases' },
+  { slug: 'postgres',    name: 'Postgres',    port: 5432,  proto: 'tcp', icon: 'database',   risk: 'high', group: 'Databases' },
+  { slug: 'mssql',       name: 'MSSQL',       port: 1433,  proto: 'tcp', icon: 'database',   risk: 'high', group: 'Databases' },
+  { slug: 'mongodb',     name: 'MongoDB',     port: 27017, proto: 'tcp', icon: 'database',   risk: 'high', group: 'Databases' },
+  { slug: 'redis',       name: 'Redis',       port: 6379,  proto: 'tcp', icon: 'zap',        risk: 'med',  group: 'Databases' },
+  // Mail
+  { slug: 'smtp',        name: 'SMTP',        port: 25,    proto: 'tcp', icon: 'mail',       risk: 'med',  group: 'Mail' },
+  { slug: 'smtp_relay',  name: 'SMTP Relay',  port: 587,   proto: 'tcp', icon: 'mail',       risk: 'med',  group: 'Mail' },
+  { slug: 'imap',        name: 'IMAP',        port: 143,   proto: 'tcp', icon: 'mail',       risk: 'med',  group: 'Mail' },
+  { slug: 'pop3',        name: 'POP3',        port: 110,   proto: 'tcp', icon: 'mail',       risk: 'med',  group: 'Mail' },
+  // Communications
+  { slug: 'sip',         name: 'SIP',         port: 5060,  proto: 'udp', icon: 'phone',      risk: 'med',  group: 'Communications' },
+  // IoT / OT
+  { slug: 'mqtt',        name: 'MQTT',        port: 1883,  proto: 'tcp', icon: 'wifi',       risk: 'low',  group: 'IoT / OT' },
+  { slug: 'modbus',      name: 'Modbus',      port: 502,   proto: 'tcp', icon: 'cpu',        risk: 'med',  group: 'IoT / OT' },
+  { slug: 'coap',        name: 'CoAP',        port: 5683,  proto: 'udp', icon: 'wifi',       risk: 'low',  group: 'IoT / OT' },
+  { slug: 'conpot',      name: 'Conpot (ICS)', port: 102,  proto: 'tcp', icon: 'cpu',        risk: 'med',  group: 'IoT / OT' },
+  // Observability
+  { slug: 'elasticsearch', name: 'Elasticsearch', port: 9200, proto: 'tcp', icon: 'activity', risk: 'med',  group: 'Observability' },
+  { slug: 'snmp',        name: 'SNMP',        port: 161,   proto: 'udp', icon: 'activity',   risk: 'low',  group: 'Observability' },
+  // Containers
+  { slug: 'docker_api',  name: 'Docker API',  port: 2375,  proto: 'tcp', icon: 'box',        risk: 'high', group: 'Containers' },
+  { slug: 'k8s',         name: 'Kubernetes',  port: 6443,  proto: 'tcp', icon: 'box',        risk: 'high', group: 'Containers' },
+  { slug: 'registry',    name: 'Registry',    port: 5000,  proto: 'tcp', icon: 'box',        risk: 'med',  group: 'Containers' },
 ];
 
diff --git a/decnet_web/src/components/MazeNET/useMazeApi.ts b/decnet_web/src/components/MazeNET/useMazeApi.ts
index 94a4257a..ff7f5bb1 100644
--- a/decnet_web/src/components/MazeNET/useMazeApi.ts
+++ b/decnet_web/src/components/MazeNET/useMazeApi.ts
@@ -263,7 +263,7 @@ export function useMazeApi(): MazeApi {
             proto: 'tcp' as const,
             icon: 'circle',
             risk: 'low' as const,
-            group: 'Remote Access' as const,
+            group: 'Miscellaneous' as const,
           },
       );
     } catch {