Luring attackers towards deception servers

A method comprising:

• receiving, by a server system, a first connection request from an agent executing on a first computer system, the agent programmed to generate the first connection request without transmitting any payload data;
• in response to the first connection request, establishing, by the server system, a first connection with the first computer system without receiving any payload data over the first connection such that no connection table entry is created on the server system but a connection table entry is created on the first computer system;
• receiving, by the server system, a second connection request from a second computer system;
• in response to the second connection request, establishing, by the server system, a second connection with the second computer system;
• receiving, by the server system, one or more packets over the second connection, the one or more packets including payload data;
• and
• in response to receiving the payload data in the one or more packets, determining that the second computer system is engaged in malicious activity whereas the first connection over which no payload data is transmitted is not determined to be a result of malicious activity;
• wherein the method further comprises:
• acquiring, by the server system, a plurality of unassigned internet protocol (IP) addresses without assigning the unassigned IP addresses to an interface;
• performing network address translation to route packets referencing the plurality of unassigned IP addresses to the server system;
• transmitting, by the server system, the plurality of unassigned IP addresses to the first computer system over a secure channel, the first connection request not being received over the secure channel;
• wherein the first connection request is addressed to one of the plurality of unassigned IP addresses.