Systems and Methods of Virtual Honeypots

Virtual honeypots methods and systems disclosed herein route all IP space of an ISP to a Darknet server as a default. When an IP address is used, it is assigned to a different server. So any IP address left on the Darknet server is an unassigned IP address. All traffic that accesses the Darknet server (the IP unassigned addresses assigned to the Darknet server as a default) is logged. Because those IP addresses are unused, it can be assumed that any traffic that hits them is the result of malicious activity. If malware is scanning the whole internet trying to spread itself, the malware will eventually access the Darknet server with the unassigned IPs.