How the decoys work
From a request reaching a decoy to a number on this site. Every step is limited on purpose.
- Decoys
- 6, fake data only
- Regions
- London, Frankfurt, Virginia, Singapore, Sydney
- Records kept
- Time, path, status, tool family
- Smallest group shown
- 5 visitors
- Records deleted after
- 90 days
Visit
A scanner, crawler, person or agent reaches a decoy
Record
Time, path, status, tool family. No bodies or cookies
Shorten
Address cut to /24 or /48. Weekly pseudonym
Count
Totals only. Groups under 5 withheld
Publish
With the method and its limits. Records deleted at 90 days
- 1
A decoy is a fake app
Each decoy looks like a carelessly built app: exposed config files, an open API, a waitlist page. It holds only invented data. Six run at once, in London, Frankfurt, Virginia, Singapore and Sydney.
- 2
A visitor arrives
Scanners, crawlers, people and (rarely) AI agents find it. Each decoy also carries a plain-text note addressed to AI agents, placed several ways, so we can see whether anything acts on it.
- 3
We record the request, not the person
Time, method, page path (no query string), response status and the kind of browser or tool. The network address is shortened (IPv4 to /24, IPv6 to /48) and a pseudonym that changes weekly stands in for the visitor. No cookies and no request bodies.
- 4
We count, then we suppress
Totals are worked out per lure and per week. Any group of fewer than five visitors is withheld. Figures run at least 24 hours behind real time.
- 5
We publish with the method
Results go on the research page with how they were counted and what they cannot show. Data releases are versioned, with a checksum and a citation. Individual records are deleted after 90 days.
More detail: privacy notice, Is this you?, data releases.