1. A computer-implemented method comprising: receiving, by a threat detection system of a first computer network, a request for a service from a threat sensor of a second computer network, the service requested of the threat sensor within the second computer network in an unsolicited request received from a network element of the second computer network; emulating the service identified in the request to generate a response to the request; sending the response to the threat sensor, the threat sensor to forward the response generated by the threat detection system to the network element within the second computer network; and analyzing one or more communications between the threat detection system and the network element during emulation of the service requested by the network element to determine whether the network element is a threat to the second network.