The Honeypot
Tripwire.
Most websites cannot tell a curious visitor from someone quietly mapping them for an attack. A handful of invisible “honeypot” paths — plus consent-respecting fingerprinting — turn your own site into a tripwire that sees the reconnaissance before the breach. Here is how it works, and its honest limits.
Every website reachable from the open internet is being read by more than its readers. Long before anyone tries to break in, they map it — quietly requesting paths, fingerprinting the stack, cataloguing what exists. Most operators never see this reconnaissance phase, because it hides in the same server logs as everything else: a wall of 404s no one reads until after something has already gone wrong.
There is a cheap, old, underused way to make that phase visible. You plant a honeypot: a path no legitimate visitor could ever have a reason to request. A fake /wp-admin on a site that has never run WordPress. A tempting /.env or /backup.zip that leads nowhere. A human clicking your public pages will never touch these. A scanner spidering for known weaknesses will — reflexively, within seconds. A honeypot request is not ambiguous the way a page view is. It is a confession.
A page view is a probability. A honeypot request is a near-certainty. No one asks for the admin panel of a site that never had one.
What one silent probe reveals — without a single cookie
The instant a request lands, before any consent prompt, the connection itself carries information. The source network and its reputation — residential, datacenter, a known VPN or cloud range. A coarse location, resolved server-side from the IP against a local geolocation database, never by shipping the visitor’s address to a third party. The user-agent and request timing, which betray automated tooling as plainly as a signature. And when the client is a real browser rather than a bare scanner, a far richer picture is available: the rendering stack, GPU, screen, and entropy that together form a stable device signature — one that recognizes the same machine again with no cookie and no login.
Fused, these turn a nameless 404 into a described event: a datacenter-hosted scanner from this network probed these fake paths, in this pattern, at this time. That is enough to tell reconnaissance apart from a customer, and to watch a campaign develop across sessions — the phase that precedes most real intrusions.
The honest limits, and the sovereign twist
Be precise about what this is and is not. It is detection, not identification. A honeypot tells you a probe happened, from where, and with what tooling — not who did it. Addresses are shared and spoofable at the edge; a device signature identifies a machine, not a name. Treated as facts, these signals mislead; treated as confidence-scored evidence, they are genuinely useful. The whole discipline is refusing to render a probability as a certainty.
It must also respect the people it is not hunting. The same instrument that catches a scanner sees ordinary visitors too — so the rich fingerprint data is minimized to nothing without explicit consent, and the geolocation stays first-party, resolved from a local database on infrastructure the operator controls, with the visitor’s address never leaving it. That constraint is not a limitation; it is the point. It is the difference between a tripwire and a dragnet.
This is the capability behind Argus Olympus, our live demo — with one inversion that makes the ethics legible: the very same capture we would use to spot a probe is shown back to the visitor, in their own browser, as a receipt of everything a page just learned about them with zero consent. A defensive tripwire for the operator; a privacy mirror for the visitor; sovereign by construction. See what your own machine gives away — then decide how you feel about it.