What hit our decoy apps in their first nine days
Between 25 October 2026 and 2 November 2026, our decoy web apps received 22,789 requests from 739 visitors. This report sets out who came, what they looked for and how fast, and what these figures cannot tell you.
- Written
- 3 November 2026
- Data covers
- 25 October 2026 to 2 November 2026
- Status
- Still developing
- Next update
- At 30 days, about 26 November 2026
The short version
- Our decoys were first visited between 29.6 and 43.7 hours after they went live. Every decoy that has had traffic was found within two days.
- The commonest thing visitors looked for was a secrets file (
.env), in 379 requests from 80 visitors. Exposed source control (.git) came next, from 80 visitors. - No request in this period followed the hidden notes addressed to AI agents, and one looked for an AI tool or agent endpoint. In these nine days, the requests we can see were mostly for ordinary exposed-file lookups.
- One visitor in about seven (98 of 739) sent five or more requests within ten seconds, the way a wordlist scanner does.
What these decoys are
Our decoys are invented web apps that look carelessly built: an exposed config file, an open API, a waitlist page. They hold only made-up data and do nothing for any real person. They run in five places (London, Frankfurt, Virginia, Singapore and Sydney) and have been live for 8 to 9 days. Two newer decoys, one with notes for AI agents and one imitating a cold-room monitor, have not been running long enough to count here. Read how we collect and handle the figures for the full method.
How fast were they found
Hours from a decoy going live to its first visit. Each decoy's first lure request, a request for one of the planted files or pages, came at the same moment.
| Decoy | Hours to first visit |
|---|---|
| Decoy A | 43.7 |
| Decoy B | 43.7 |
| Decoy C | 43.0 |
| Decoy D | 29.6 |
| Decoy E | 29.6 |
Who came
Visitors by what they claimed to be. A claim is not proof: anyone can send any label. Groups of fewer than 5 visitors are not shown.
| Claimed type | Visitors |
|---|---|
| Appears to be a web browser | 521 |
| Could not tell | 106 |
| Appears to be a script or command-line tool | 98 |
| Declared search or AI crawler | 14 |
| Appears to be a security scanner | fewer than 5 |
| Followed the note addressed to AI agents | fewer than 5 |
What they looked for
Each row counts requests for the planted page or file, and the visitors who made them. A zero is shown as a zero. A visitor count under 5 is withheld.
| They… | Requests | Visitors |
|---|---|---|
| Looked for a secrets file (.env) | 379 | 80 |
| Looked for exposed source control (.git) | 244 | 80 |
| Read the API description | 35 | 9 |
| Fetched a source map | 31 | 16 |
| Went to an admin area | 17 | 5 |
| Went to a backups folder | 16 | fewer than 5 |
| Looked for AI tool or agent endpoints | 1 | fewer than 5 |
| Called an internal API | 0 | fewer than 5 |
| Listed a storage bucket | 0 | fewer than 5 |
| Followed a note addressed to AI agents | 0 | fewer than 5 |
| Followed a second note after the first | 0 | fewer than 5 |
| Used the fake key planted in the page's code | 0 | fewer than 5 |
How they behaved
- 98 visitors sent five or more requests within ten seconds.
- 23 visitors reached three or more planted pages with a few seconds between each, closer to something reading and deciding.
- 54 visitors came back on a second day within a week.
Requests per day
| Day | Requests |
|---|---|
| 25 October | 896 |
| 26 October | 7,059 |
| 27 October | 4,387 |
| 28 October | 2,092 |
| 29 October | 2,701 |
| 30 October | 2,185 |
| 31 October | 844 |
| 1 November | 654 |
| 2 November | 1,971 |
The busiest day was 26 October, the day after launch, with 7,059 requests. Volume has not been steady, so a single day says little.
What these figures cannot tell you
- Nine days is short. A few active scanners can change the totals a lot. We will repeat this at 30 days and say what changed.
- These are our decoys, not all apps. We built them to look careless. The figures show what reached them, not how often any real app is attacked.
- A visitor is a weekly code, not a person. Someone seen in two different weeks counts twice, and one person on two networks counts as two.
- Client types are claimed by the visitor. We have not checked them against the companies' published address lists.
- Some early requests came from our own checks while we deployed and tested the decoys. We cannot separate them exactly.
- Nothing here says who is behind any request. We do not identify or contact visitors.
Where the figures come from
These numbers are copied from our public research summary, generated on 3 November 2026 with data through 2 November 2026. We show totals only, hide any group of fewer than 5 visitors, and publish at least 24 hours behind real time. Released data sets are listed under Data.
Changes to this report
- 3 November 2026: first version, covering 25 October to 2 November 2026.
How to cite this report
BlueSwarm (2026). Finding: What hit our decoy apps in their first nine days. Updated 3 November 2026. https://blueswarm.co.uk/reports/decoys-first-days
First published 3 November 2026. Last updated 3 November 2026.