Honeypot Location Diversity and Data Quality

This report outlines best practices for honeypot deployment to distinguish background noise from targeted activity, showing diminishing returns for additional sensors within the same provider and stressing the need for provider diversity to avoid bias and attacker evasion. It shares observations on traffic coverage across cloud providers and explains how combining globally distributed honeypot data with local telemetry (e.g., via GreyNoise sensors) can highlight what is unique to your environment while filtering commonplace noise.