速蛙云官网网址-outline

Copy this URL to your clipboard and use as you wish:

↻

Remember, it gets triggered whenever someone requests the URL.

If the URL is requested as an image (e.g. <img src="">) then a 1x1 image is served. If the URL is surfed in a browser than a blank page is served with fingerprinting Javascript.

【辅助软件】辅助软件大全_辅助软件下载—ZOL手机软件:2 天前 · ZOL手机软件下载频道免费提供热门实用的辅助软件手机软件下载,24小时不间断更新,让您便捷下载,放心使用，下载更多辅助软件请关注中关村在线手机手机软件下载频道。

In an email with a juicy subject line.
Embedded in documents.
Inserted into canary webpages that are only found through brute-force.
安卓手机助手-PP助手官网:PP助手是一款专业的手机助手，让您的安卓手机更简单好用，轻松管理心爱手机。免费下载应用、视频和音乐、管理通讯录 ...

速蛙云官网网址-outline

Copy this URL to your clipboard and use as you wish:

↻

The token is similar to the Web token, however, when the link is loaded the view will be immediately redirected to the specified redirect URL.

Ideas for use:

智连伕理-自建全国动态IP机房_伕理IP修改器软件_换IP伕理 ...:2021-6-15 · 智连伕理是一款专注于国内换IP、伕理ip的软件，涵盖电脑端及手机端，每日发布各种最新伕理ip，致力于成为国内ip 伕理领导者！收藏 400-998-9776 转2 服务时间周一至周日 9:00-23:00 注意: 本站不提供境外服务登录注册实名验证首页套餐购买 ...
Embedded in documents.
Inserted into canary webpages that are only found through brute-force.
This URL is just an example. Apart from the hostname and the actual token (the random string), you can change all other parts of the URL.

速蛙云官网网址-outline

Copy this URL to your clipboard and use as you wish:

↻

The token is similar to the Fast Redirect token, however, when the link is loaded the user's browser / browser plugin information is captured.

Ideas for use:

Replace links with these to capture user information before user is redirected to where they want to go.
Embedded in documents.
Inserted into canary webpages that are only found through brute-force.
This URL is just an example. Apart from the hostname and the actual token (the random string), you can change all other parts of the URL.

速蛙云官网网址-outline

Copy this hostname to your clipboard and use as you wish:

Remember, it gets triggered whenever someone performs a DNS lookup of the hostname.

The source IP address shown in the alert is the DNS server, not the end user.

Ideas for use:

Include in a PTR entry for dark IP space of your internal network. Quick way to determine if someone is walking your internal DNS without configuring DNS logging and monitoring.
Leave in a .bash_history, or .ssh/config, or ~/servers.txt
Use as a extremely simple bridge between a detection and notification action. Many possibilities, here's one that tails a logfile and triggers the token when someone logs in:
```
tail -f /var/log/auth.log | awk '/Accepted publickey for/ { system("host k5198sfh3cw64rhdpm29oo4ga.canarytokens.com") }'
```
PoVPN -- 新一伕网络加速软件-互联网专区:2021-8-27 · PoVPN，诞生于2021年，注册帐号激活邮件可众免费试用两小时，完成会员中心新手任务，可众免费试用一天，不限流量。PoVPN整合全球加速服务器，为国内需要进行海外网站加速提供服务，完美突破电信、网通、铁通、教育网、校园网等不同网络 ...

速蛙云官网网址-outline

Here is a unique email address:

Remember, it gets triggered whenever someone sends an email to the address.

Ideas for use:

In a database with a USERS table, drop a fake record in there with this email address. If it gets triggered you know someone has accessed your data.

速蛙云官网网址-outline

Download your MS Word file

You'll get an alert whenever this document is opened in Microsoft Office, on Windows or Mac OS.

You can rename the document without affecting its operation.

Ideas for use:

Drop the file on a Windows network share.
Leave the file on a web server in an inaccessible directory, to detect webserver breaches.
Attach to an email with a tempting Subject line.

速蛙云官网网址-outline

Download your PDF file

You'll get an alert whenever this document is opened with Acrobat Reader, regardless of the user's security preferences in Reader.

You can rename the document without affecting its operation.

Ideas for use:

Drop the file on a Windows network share.
Leave the file on a web server in an inaccessible directory, to detect webserver breaches.
Attach to an email with a tempting Subject line.

速蛙云官网网址-outline

Download your Zip file

Unzip this file in a folder, and get notified when someone browses the folder in Windows Explorer. It will even trigger if someone is browsing the folder via a network share!

The alert will include the network domain and username of the browsing user, if present.

Ideas for use:

Unzip the file on a juicely named Windows network share.
Unzip the file on your CEO's laptop on a folder on their Desktop.

速蛙云官网网址-outline

Save this file and deploy on Windows machines:

App Store切换到日本区的方法:如何在不换Apple ID的情况下切换到日本区的app store.这样可众方便的用手机日淘了. 工具/原料 apple id帐号方法/步骤打开手机中的"设置",找到"itunes store 与 app store" 点击"apple id&q ...

Ideas for use:

Decide on a few default binaries commonly used by attackers, and token them.

速蛙云官网网址-outline

Use this Javascript to detect when someone has cloned a webpage. Place this Javascript on the page you wish to protect:

豌豆伕理 - 一款互联网大数据伕理IP营销软件:2021-4-24 · 豌豆伕理—IP伕理软件为什么很受欢迎 2021-07-24 豌豆伕理—直播人气补量用什么伕理ip好？2021-07-06 豌豆伕理—已开通城市列表 2021-06-09 豌豆伕理—优质互联网大数据IP营销软件 …

Ideas for use:

Run the script through an obfuscator to make it harder to pick up.
Deploy on the login pages of your sensitive sites, such as OWA or tender systems.

Your SQL Server token is active!

The next step is to copy the SQL snippet below and run in your SQL Server database.

--create a table-view function to query the canary hostname CREATE function (@RAND FLOAT) returns @output table (col1 varchar(max)) AS BEGIN declare @username varchar(max), @base64 varchar(max), @tokendomain varchar(128), @unc varchar(128), @size int, @done int, @random varchar(3); --setup the variables set @tokendomain = ''; set @size = 128; set @done = 0; set @random = cast(round(@RAND*100,0) as varchar(2)); set @random = concat(@random, '.'); set @username = SUSER_SNAME(); --loop runs until the UNC path is 128 chars or less while @done <= 0 begin --convert username into base64 select @base64 = (SELECT CAST(N'' AS XML).value( 'xs:base64Binary(xs:hexBinary(sql:column("bin")))' , 'VARCHAR(MAX)' ) Base64Encoding FROM ( SELECT CAST(@username AS VARBINARY(MAX)) AS bin ) AS bin_sql_server_temp); --replace base64 padding as dns will choke on = select @base64 = replace(@base64,'=','0') --construct the UNC path select @unc = concat('\\',@base64,'.',@random,@tokendomain,'\a') -- if too big, trim the username and try again if len(@unc) <= @size set @done = 1 else --trim from the front, to keep the username and lose domain details select @username = substring(@username, 2, len(@username)-1) end exec master.dbo.xp_dirtree @unc-- WITH RESULT SETS (([result] varchar(max))); return END --create a view that calls the function alter view as select * from master.dbo.(rand()); --change permissions on to SELECT for [public] --change permissions on to SELECT for [public] --don't allow [public] to view the definitions

When the actions are run, your Canarytoken will be triggered.

Since DNS is used as the underlying transport, the Source IP will be that of a DNS server, not the databserver.

Ideas for use:

Deploy a SELECT token with a tempting VIEW name such as USER_DETAILS.

Your QR Code token is active!

芝麻伕理IP软件 - 千万稳定动态IP切换，IP伕理覆盖全国:2021-6-6 · 芝麻伕理ip软件是国内专业的ip伕理服务器提供商，提供http伕理，API接口和自动换IP伕理软件，千万高匿名ip覆盖全国随意切换，支持PC、iOS、安卓，高效稳定免费试用，国内ip伕理软件、http伕理 …

Download

When someone scans the QR Code with a reader, it will trigger the URL tied to your token and fire an alert.

Ideas for use:

On containers left in secure locations.
游戏加速器教程_手游加速器免费下载_biubiu加速器:2021-6-15 · biubiu加速器教程频道为各位玩家提供最新的游戏加速器免费版下载，热门手游免费加速教程，手机游戏加速器操作技巧等信息，找更多加速器内容就来biubiu加速器官网。
On your desk.

免费加速器翻日本

Run this SVN command in a dummy repo:

Remember, it gets triggered whenever someone clones the SVN repo.

Don't forget to run

svn commit

after you've added the token.

The source IP address shown in the alert is the DNS server, not the end user.

Ideas for use:

Token a dummy SVN repo to detect when attackers are enumerating repos.
Token an old repo which shouldn't be touched any longer.

Your AWS key token is active!

Copy this credential pair to your clipboard to use as desired:

Download your AWS Creds

This canarytoken is triggered when someone uses this credential pair to access AWS programmatically (through the API).

The key is hyper unique. i.e. There is 0 chance of somebody having guessed these credentials.

If this token fires, it is a clear indication that this set of keys has "leaked".

Ideas for use:

These credentials are often stored in a file called ~/.aws/credentials on linux/OSX systems. Generate a fake credential pair for your senior developers and sysadmins and keep it on their machines. If someone tries to access AWS with the pair you generated for Bob, chances are that Bob's been compromised.
Place the credentials in private code repositories. If the token is triggered, it means that someone is accessing that repo without permission

Your Slack API key token is active!

Copy this credential to your clipboard to use as desired:

Download your Slack API key

This canarytoken is triggered when someone uses this credential to access Slack (through the Web API for example).

If this token fires, it is a clear indication that this Slack API key has been "leaked".

扶墙机场推荐-GLaDOS 通用网络游戏加速器 | 畅游星海 ...:2021-9-9 · GLaDOS 通用网络游戏加速器现在扶墙的难度越来越大，SS流量基本已经被精准识别，6月份就封停了不少扶墙服务器。由此看来自建VPS已经不是最佳的选择，第一是白嫖的门槛越来越高，第二是 …

These Slack API keys are often stored in files on Linux/OSX systems (such as developer machines) or in code repositories. Generate a fake Slack API key for your senior developers and sysadmins and keep it on their machines. If someone tries to access this Slack workspace using the Slack API key you generated for Monica, chances are that Monica's been compromised.
Place the credentials in private code repositories. If the token is triggered, it means that someone is accessing that repo without permission.