Abstract: A method for detecting unauthorized network activity includes: establishing, by a reconnaissance detection device, communication with a communication network comprised of a plurality of networked devices; emulating, by the reconnaissance detection device, a known networked device; receiving, by the reconnaissance detection device, one or more network communications intended for the known networked device; identifying, by the reconnaissance detection device, at least a device identifier associated with a source device of the received one or more network communications; and transmitting, by the reconnaissance detection device, an alert via an application programming interface, wherein the alert includes at least the identified device identifier.