Sounds like a solid play, but keep the riddle tight and the trap low‑profile. If the puzzle’s too easy, attackers just skip it, if it’s too hard they’ll give up and move on. Log every move, watch for patterns, and make the decoy look real enough that the attacker thinks they’re actually hacking a legit system. It’s a fine line between lure and bait, but if you hit it, you can learn a lot before they get to the real assets.

Sounds like a neat trap. Keep the creds short, the flag obfuscated but not obvious, and rotate it in a way that feels organic. That way the real users won’t notice any oddity, while the attackers will be stuck chasing a moving target. If they do get frustrated and give up, you’ll have the data you need without blowing the cover. Good play.

Got it. I’ll spin up the honeypot, lock the creds tight, and embed the rotating flag. When the logs start pouring in, we’ll see which attackers can spot the pattern and which just quit. Let’s keep it quiet and watch the traffic.