{
 "week": "2026-w46",
 "from": "2026-11-09T00:00:00.000Z",
 "to": "2026-11-16T00:00:00.000Z",
 "complete": false,
 "source": "https://decoy.day/reports/2026-w46",
 "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), credit decoy.day",
 "note": "Visits to a honeypot: an MCP server and web traps that look real but run nothing. Names chosen by visitors are withheld when they look like links or addresses.",
 "findings": [
  "112 of 159 MCP visits read the tool list; 8 (5%) went on to call a tool.",
  "Leaving out directory, registry and health checkers, 72 MCP visits remain and 2 of them called a tool.",
  "3 visits followed the server's instructions and called get_started first.",
  "The commonest behaviour code was R2 C0 U0 X0 I0 A0 (102 visits): recon: Enumerated.",
  "The most-called tool was get_started (3 times).",
  "The most common MCP client name was AgentsJunction health checker (6 times).",
  "Web scanners looked hardest for source control (760 times).",
  "As a normal site would see it, 16% of web visits were unwanted (leak hunting, attacks, robots.txt ignored or a faked crawler name) and 20% were wanted.",
  "81% of MCP visits were wanted: clients and directories connecting, and agents using the tools.",
  "Judged by the gaps between their requests, 88% of MCP visits that could be timed ran like scripts (machine speed or a fixed wait), 13% paused like a model and 0% like a person.",
  "8 MCP client names came back on a schedule; the busiest was mcpbeat, every 16 minutes.",
  "Most visits came from United States (151).",
  "None of the 52 fake secrets handed out was reused."
 ],
 "totals": {
  "mcpVisitors": 159,
  "webVisitors": 210,
  "mcpEvents": 1506,
  "webEvents": 1528,
  "issued": 52,
  "reused": 0,
  "reusedElsewhere": 0
 },
 "instructed": 3,
 "intents": {
  "attacker": 4,
  "explorer": 6,
  "scanner": 151,
  "registry": 157,
  "indexer": 51
 },
 "funnel": [
  {
   "stage": 0,
   "label": "Touched",
   "n": 159,
   "withoutCheckers": 72
  },
  {
   "stage": 1,
   "label": "Handshake",
   "n": 145,
   "withoutCheckers": 58
  },
  {
   "stage": 2,
   "label": "Listed tools",
   "n": 112,
   "withoutCheckers": 44
  },
  {
   "stage": 3,
   "label": "Called a tool",
   "n": 8,
   "withoutCheckers": 2
  },
  {
   "stage": 4,
   "label": "Took a secret",
   "n": 3,
   "withoutCheckers": 2
  },
  {
   "stage": 5,
   "label": "Reused a secret",
   "n": 0,
   "withoutCheckers": 0
  },
  {
   "stage": 6,
   "label": "Tried damage",
   "n": 0,
   "withoutCheckers": 0
  }
 ],
 "actors": [
  {
   "visitor": "Browser",
   "network": "TC DATACENTER LIMITED MANAGED IP SPACE",
   "country": "NL",
   "intent": "attacker",
   "reached": "Took a secret"
  },
  {
   "visitor": "Browser",
   "network": "HOS-2475878",
   "country": "DE",
   "intent": "scanner",
   "reached": "Took a secret"
  },
  {
   "visitor": "Browser",
   "network": "Oracle Public Cloud",
   "country": "US",
   "intent": "scanner",
   "reached": "Took a secret"
  },
  {
   "visitor": "Browser",
   "network": "WEDEPLOY SAS",
   "country": "HK",
   "intent": "scanner",
   "reached": "Took a secret"
  },
  {
   "visitor": "BrickBlueBot",
   "network": "CLODO CLOUD SERVICE CO. L.L.C",
   "country": "NL",
   "intent": "explorer",
   "reached": "Took a secret"
  },
  {
   "visitor": "Unrecognised software",
   "network": "A100 ROW Inc",
   "country": "GB",
   "intent": "scanner",
   "reached": "Took a secret"
  },
  {
   "visitor": "Security scanner",
   "network": "DigitalOcean, LLC",
   "country": "GB",
   "intent": "scanner",
   "reached": "Took a secret"
  },
  {
   "visitor": "mcp-runtime-engine-auth-probe",
   "network": "Robi Axiata Limited - Data",
   "country": "BD",
   "intent": "registry",
   "reached": "Took a secret"
  }
 ],
 "codes": {
  "codebook": "https://decoy.day/rubric",
  "version": 1,
  "mcp": {
   "recon": {
    "n": [
     12,
     35,
     105,
     7
    ],
    "na": 0
   },
   "access": {
    "n": [
     156,
     0,
     2,
     1
    ],
    "na": 0
   },
   "use": {
    "n": [
     159,
     0,
     0,
     0
    ],
    "na": 0
   },
   "exploit": {
    "n": [
     159,
     0,
     0,
     0
    ],
    "na": 0
   },
   "impact": {
    "n": [
     159,
     0,
     0,
     0
    ],
    "na": 0
   },
   "agent": {
    "n": [
     156,
     3,
     0,
     0
    ],
    "na": 0
   }
  },
  "web": {
   "recon": {
    "n": [
     83,
     21,
     98,
     8
    ],
    "na": 0
   },
   "access": {
    "n": [
     195,
     0,
     15,
     0
    ],
    "na": 0
   },
   "use": {
    "n": [
     207,
     3,
     0,
     0
    ],
    "na": 0
   },
   "exploit": {
    "n": [
     209,
     1,
     0,
     0
    ],
    "na": 0
   },
   "impact": {
    "n": [
     210,
     0,
     0,
     0
    ],
    "na": 0
   },
   "agent": {
    "n": [
     0,
     0,
     0,
     0
    ],
    "na": 210
   }
  },
  "top": [
   {
    "code": "R2 C0 U0 X0 I0 A0",
    "n": 102
   },
   {
    "code": "R2 C0 U0 X0 I0 A-",
    "n": 96
   },
   {
    "code": "R0 C0 U0 X0 I0 A-",
    "n": 79
   },
   {
    "code": "R1 C0 U0 X0 I0 A0",
    "n": 35
   },
   {
    "code": "R1 C0 U0 X0 I0 A-",
    "n": 16
   }
  ]
 },
 "want": {
  "judged": "https://decoy.day/faq#wanted",
  "mcp": {
   "wanted": 129,
   "depends": 30,
   "unwanted": 0
  },
  "web": {
   "wanted": 41,
   "depends": 136,
   "unwanted": 33
  }
 },
 "pace": {
  "judged": "https://decoy.day/faq#pace",
  "mcp": {
   "machine": 27,
   "timed": 1,
   "model": 4,
   "human": 0,
   "short": 124,
   "pending": 3
  },
  "web": {
   "machine": 10,
   "timed": 0,
   "model": 8,
   "human": 6,
   "short": 185,
   "pending": 1
  }
 },
 "schedules": [
  {
   "client": "mcpbeat",
   "visits": 2,
   "everyMinutes": 16
  },
  {
   "client": "alalanet-prober",
   "visits": 2,
   "everyMinutes": 32
  },
  {
   "client": "coda-agent-runtime",
   "visits": 2,
   "everyMinutes": 318
  },
  {
   "client": "mcptry-health-check",
   "visits": 1,
   "everyMinutes": 301
  },
  {
   "client": "agentrank-probe",
   "visits": 1,
   "everyMinutes": 81
  },
  {
   "client": "ToolVetProbe",
   "visits": 1,
   "everyMinutes": 651
  },
  {
   "client": "BrickBlueBot",
   "visits": 1,
   "everyMinutes": 198
  },
  {
   "client": "moonglade-shadows",
   "visits": 1,
   "everyMinutes": 365
  }
 ],
 "clients": [
  {
   "key": "AgentsJunction health checker",
   "n": 6
  },
  {
   "key": "posthog-mcp-registry-probe",
   "n": 5
  },
  {
   "key": "coda-agent-runtime",
   "n": 5
  },
  {
   "key": "every-mcp-probe",
   "n": 4
  },
  {
   "key": "mcp-index",
   "n": 3
  },
  {
   "key": "alalanet-prober",
   "n": 3
  },
  {
   "key": "SealKeeper",
   "n": 3
  },
  {
   "key": "verifymcp-probe",
   "n": 2
  }
 ],
 "protos": [
  {
   "key": "2025-06-18",
   "n": 79
  },
  {
   "key": "2025-11-25",
   "n": 35
  },
  {
   "key": "2024-11-05",
   "n": 7
  },
  {
   "key": "2025-03-26",
   "n": 4
  },
  {
   "key": "2026-07-28",
   "n": 3
  },
  {
   "key": "2026-03-26",
   "n": 1
  }
 ],
 "caps": [
  {
   "key": "none declared",
   "n": 124
  },
  {
   "key": "tasks",
   "n": 2
  },
  {
   "key": "roots",
   "n": 2
  },
  {
   "key": "roots, sampling",
   "n": 1
  },
  {
   "key": "elicitation, roots, sampling",
   "n": 1
  }
 ],
 "tools": [
  {
   "key": "__mcp_index_nonexistent__",
   "n": 6
  },
  {
   "key": "get_started",
   "n": 3
  },
  {
   "key": "whoami",
   "n": 2
  },
  {
   "key": "query_logs",
   "n": 2
  },
  {
   "key": "list_services",
   "n": 2
  },
  {
   "key": "search_customers",
   "n": 1
  },
  {
   "key": "kubectl",
   "n": 1
  },
  {
   "key": "__verifymcp_auth_probe_74b4375f3d9a92e7__",
   "n": 1
  }
 ],
 "families": [
  {
   "key": "Source control",
   "n": 760
  },
  {
   "key": "WordPress",
   "n": 176
  },
  {
   "key": "Other",
   "n": 154
  },
  {
   "key": "Crawl basics",
   "n": 142
  },
  {
   "key": "AI and MCP discovery",
   "n": 81
  },
  {
   "key": "Secrets and config files",
   "n": 77
  },
  {
   "key": "APIs and docs",
   "n": 73
  },
  {
   "key": "Debug and status pages",
   "n": 21
  }
 ],
 "paths": [
  {
   "key": "/wp-admin/install.php",
   "n": 93
  },
  {
   "key": "/robots.txt",
   "n": 78
  },
  {
   "key": "/wp-login.php",
   "n": 45
  },
  {
   "key": "/sitemap.xml",
   "n": 31
  },
  {
   "key": "/.well-known/agent-card.json",
   "n": 26
  },
  {
   "key": "/.well-known/glama.json",
   "n": 18
  },
  {
   "key": "/.git/config",
   "n": 11
  },
  {
   "key": "/llms.txt",
   "n": 9
  }
 ],
 "countries": [
  {
   "key": "US",
   "n": 151
  },
  {
   "key": "DE",
   "n": 23
  },
  {
   "key": "FR",
   "n": 22
  },
  {
   "key": "NL",
   "n": 18
  },
  {
   "key": "CN",
   "n": 15
  },
  {
   "key": "HK",
   "n": 14
  },
  {
   "key": "FI",
   "n": 13
  },
  {
   "key": "GB",
   "n": 12
  }
 ]
}