“Instead of informing an attacker that a port is CLOSED or FILTERED, Portspoof returns SYN+ACK for every connection attempt.”
Portspoof answers on all 65,535 TCP ports and feeds scanners from over 9,000 fake service signatures. Every port looks open and every banner looks real. A port scan that should take minutes turns into a pile of garbage the attacker has to verify by hand. Lying back to the scanner is cheap, and it costs them far more than it costs you.