canaryWeb URL (webhook)
A unique URL that logs every visit. Drop it where only an intruder would look.
Deploy →Canary tokens & decoys
for the ones doing the hunting.
Plant a tripwire anywhere — a URL, a tracking pixel, a document, a DNS name — and know the moment someone touches it. Built for security researchers, pentesters and red teamers doing OSINT and threat-landscape work.
Canary types
Pick a decoy. Each one logs the IP, user-agent and full request the instant it fires.
Tracking image
An image (1×1 pixel up to a full banner/SVG) that fires when loaded.
Deploy →Redirect URL
Logs the visit, then forwards the browser to a destination you choose.
Deploy →QR code
A QR that routes through us (MITM) and forwards to your URL, logging the scan.
Deploy →JS / CSS asset
A script or stylesheet that reports the referring page/domain that loaded it.
Deploy →Social share link
A shareable link with custom OpenGraph/Twitter meta that logs unfurls & clicks.
Deploy →Document
Word/PDF documents with an embedded tracker that fires on open.
Deploy →Email address
A catch-all inbox address; delivery to it triggers the canary.
Deploy →DNS token
A hostname under our delegated zone; any DNS lookup of it fires the canary.
Deploy →Windows folder
A folder with a desktop.ini that fires when browsed in Explorer.
Deploy →Windows shortcut
A .lnk shortcut whose icon fires when the folder is merely viewed.
Deploy →Fake login portal
A convincing decoy login page; visits (and typed usernames) are logged.
Deploy →Secrets / config file
A realistic .env / kubeconfig / creds file with an embedded canary endpoint.
Deploy →Calendar invite
An .ics invite with a tracking image that fires when the invite is opened.
Deploy →Cloned-site beacon
A JS snippet for your pages that fires when run on a foreign (phishing) origin.
Deploy →AWS API key
A deny-all AWS IAM key you deploy via our generated template; any use alerts you.
Deploy →Log4Shell / JNDI
A ${jndi:...} string that fires when a vulnerable Log4j pipeline resolves it.
Deploy →Loads from anywhere
Pixels, scripts and stylesheets are served with open CORS so your decoys embed on any origin — an email, a foreign site, a stolen repo.
Stay signed in
A trigger can take days. Sessions last a week and remember you, so you're never locked out while you wait for the trap to spring.
Alert your way
Route hits to Discord, Slack, a raw webhook or email. Everything — types, settings, logs — is driven from the database.