2 November 2026
Money for Nothing
The first 74 canary keys: they came for AI on somebody else’s bill, so we rebuilt the shop. Twice as many keys got used, and not one got further than ‘who am I?’.
Read more →
The Blog
Notes from the treacle — what the honeypots actually caught.
22 October 2026
Don’t Stop Me Now
Analysis of the gaps from researching the logs showed many attackers searching for AI-proxy config files. Release 2026.11 is out early, filling those gaps: more bait where it’s actually wanted, a story per site, a login for every app, and handing attackers AI cloud keys that only ever answer ‘who am I?’.
Read more →
16 October 2026
I Just Can’t Get Enough
One visitor has come back to malk.ch four times in a week, sucking up MIRE content, and has tried one of the new canary keys in three waves with 281 calls, in a rush to use it before expiry. Another visitor takes a key every other morning and checks it within a second. Only the “who am I?” calls have ever worked.
Read more →
12 October 2026
Three Keys, Three Hands
Three canary AWS keys have now been used: by a person who read our privacy policy and security.txt, by a scanner that never stops, and in a 111-second shopping list for AI models, texts and email. Only the “who am I?” checks worked.
Read more →
11 October 2026
Too Good a Trap
A crawler on Alibaba Cloud spent three weeks walking ever deeper into a maze The MIRE built on purpose, doubling its requests every two days until the honeypot risked taking itself down. So we gave the maze a floor, and made every step cost time.
Read more →
9 October 2026
The Keys That Bite Back
Since February The MIRE has handed out more than 25’000 AWS keys, every one of them fake. If anyone tried one, we never knew. Now some of them are real – and they report back to us.
Read more →Loading more…