A cyber threat deception method, comprising: obtaining, by a forwarding device, a deception target set, wherein the deception target set comprises at least one deception target, and the at least one deception target comprises an unused internet protocol, IP, address or an unopened port number on a used IP address; receiving, by the forwarding device, a first IP packet from a first host; determining, by the forwarding device, whether a destination party that the first IP packet requests to access belongs to the deception target set; if the destination party that the first IP packet requests to access belongs to the deception target set, sending, by the forwarding device, the first IP packet to a honeypot management server; receiving, by the forwarding device, a second IP packet returned by the honeypot management server, wherein the second IP packet is a response packet of the first IP packet; sending, by the forwarding device, the second IP packet to the first host; characterized in that: after the obtaining a deception target set, the method further comprises: forwarding, by the forwarding device, a domain name system, DNS, domain name request; intercepting and stopping forwarding, by the forwarding device, a first DNS response packet, wherein the first DNS response packet is a response packet of the DNS domain name request, and the first DNS response packet indicates that a domain name queried by the DNS domain name request does not exist; generating, by the forwarding device, a second DNS response packet, wherein the second DNS response packet comprises an IP address corresponding to the domain name queried by the DNS domain name request, and the IP address corresponding to the domain name is an unused IP address in the deception target set; and sending, by the forwarding device, the second DNS response packet. obtaining, by a forwarding device, a deception target set, wherein the deception target set comprises at least one deception target, and the at least one deception target comprises an unused internet protocol, IP, address or an unopened port number on a used IP address; receiving, by the forwarding device, a first IP packet from a first host; determining, by the forwarding device, whether a destination party that the first IP packet requests to access belongs to the deception target set; if the destination party that the first IP packet requests to access belongs to the deception target set, sending, by the forwarding device, the first IP packet to a honeypot management server; receiving, by the forwarding device, a second IP packet returned by the honeypot management server, wherein the second IP packet is a response packet of the first IP packet; sending, by the forwarding device, the second IP packet to the first host; characterized in that: after the obtaining a deception target set, the method further comprises: forwarding, by the forwarding device, a domain name system, DNS, domain name request; intercepting and stopping forwarding, by the forwarding device, a first DNS response packet, wherein the first DNS response packet is a response packet of the DNS domain name request, and the first DNS response packet indicates that a domain name queried by the DNS domain name request does not exist; generating, by the forwarding device, a second DNS response packet, wherein the second DNS response packet comprises an IP address corresponding to the domain name queried by the DNS domain name request, and the IP address corresponding to the domain name is an unused IP address in the deception target set; and sending, by the forwarding device, the second DNS response packet. forwarding, by the forwarding device, a domain name system, DNS, domain name request; intercepting and stopping forwarding, by the forwarding device, a first DNS response packet, wherein the first DNS response packet is a response packet of the DNS domain name request, and the first DNS response packet indicates that a domain name queried by the DNS domain name request does not exist; generating, by the forwarding device, a second DNS response packet, wherein the second DNS response packet comprises an IP address corresponding to the domain name queried by the DNS domain name request, and the IP address corresponding to the domain name is an unused IP address in the deception target set; and sending, by the forwarding device, the second DNS response packet.