A method, comprising: providing, by a compute instance comprising an Infrastructure-as-a-Service, IaaS, compute instance controlled by a controller of an IaaS service provider corresponding to an IaaS service provider environment, a plurality of honeypot servers, each honeypot server of the plurality of honeypot servers comprising a honeypot type; luring, by the compute instance, an attacker to establish a session with at least one honeypot server of the plurality of honeypot servers; receiving, by the compute instance, a first request from the attacker, the first request related to the instance and including a request characteristic; identifying, by the compute instance, a particular honeypot server of the plurality of honeypot servers based at least in part on the request characteristic and the honeypot type; establishing, by the compute instance, a session with the attacker for connection with the particular honeypot server; generating, by the particular honeypot server of the compute instance, a response to a second request from the attacker, wherein the IaaS compute instance is executed by a third party service provider outside of the IaaS service provider environment, and wherein the response to the second request is configured to appear to be from the IaaS service provider; causing, by the particular honeypot server of the compute instance, the response to be communicated to the attacker responsive to the second request; and recording, by the compute instance, data related to the attacker or data related to one or more interactions by the attacker with the particular honeypot server. providing, by a compute instance comprising an Infrastructure-as-a-Service, IaaS, compute instance controlled by a controller of an IaaS service provider corresponding to an IaaS service provider environment, a plurality of honeypot servers, each honeypot server of the plurality of honeypot servers comprising a honeypot type; luring, by the compute instance, an attacker to establish a session with at least one honeypot server of the plurality of honeypot servers; receiving, by the compute instance, a first request from the attacker, the first request related to the instance and including a request characteristic; identifying, by the compute instance, a particular honeypot server of the plurality of honeypot servers based at least in part on the request characteristic and the honeypot type; establishing, by the compute instance, a session with the attacker for connection with the particular honeypot server; generating, by the particular honeypot server of the compute instance, a response to a second request from the attacker, wherein the IaaS compute instance is executed by a third party service provider outside of the IaaS service provider environment, and wherein the response to the second request is configured to appear to be from the IaaS service provider; causing, by the particular honeypot server of the compute instance, the response to be communicated to the attacker responsive to the second request; and recording, by the compute instance, data related to the attacker or data related to one or more interactions by the attacker with the particular honeypot server.