A method, comprising: providing , by a compute instance comprising an Infrastructure-as-a-Service, IaaS, compute instance controlled by a controller of an IaaS service provider corresponding to an IaaS service provider environment, a plurality of honeypot servers, each honeypot server of the plurality of honeypot servers comprising a honeypot type; luring , by the compute instance, an attacker to establish a session with at least one honeypot server of the plurality of honeypot servers; receiving , by the compute instance, a first request from the attacker, the first request related to the instance and including a request characteristic; identifying , by the compute instance, a particular honeypot server of the plurality of honeypot servers based at least in part on the request characteristic and the honeypot type; establishing , by the compute instance, a session with the attacker for connection with the particular honeypot server; generating , by the particular honeypot server of the compute instance, a response to a second request from the attacker, wherein the IaaS compute instance is executed by a third party service provider outside of the IaaS service provider environment, and wherein the response to the second request is configured to appear to be from the IaaS service provider; causing , by the particular honeypot server of the compute instance, the response to be communicated to the attacker responsive to the second request; and recording , by the compute instance, data related to the attacker or data related to one or more interactions by the attacker with the particular honeypot server. providing , by a compute instance comprising an Infrastructure-as-a-Service, IaaS, compute instance controlled by a controller of an IaaS service provider corresponding to an IaaS service provider environment, a plurality of honeypot servers, each honeypot server of the plurality of honeypot servers comprising a honeypot type; luring , by the compute instance, an attacker to establish a session with at least one honeypot server of the plurality of honeypot servers; receiving , by the compute instance, a first request from the attacker, the first request related to the instance and including a request characteristic; identifying , by the compute instance, a particular honeypot server of the plurality of honeypot servers based at least in part on the request characteristic and the honeypot type; establishing , by the compute instance, a session with the attacker for connection with the particular honeypot server; generating , by the particular honeypot server of the compute instance, a response to a second request from the attacker, wherein the IaaS compute instance is executed by a third party service provider outside of the IaaS service provider environment, and wherein the response to the second request is configured to appear to be from the IaaS service provider; causing , by the particular honeypot server of the compute instance, the response to be communicated to the attacker responsive to the second request; and recording , by the compute instance, data related to the attacker or data related to one or more interactions by the attacker with the particular honeypot server. <EOS>