Knowledge base
Short articles from the HorasEye team. For a specific token in your account, the in-app guides under Dashboard → Guides go deeper.
What is a honeytoken?
A decoy credential, file, or DNS name that should never be used. If it is, you get an alert.
2 min · basics
Drop your first HTTP beacon in five minutes
Create an HTTP or web-image token, embed the URL, and confirm a test trigger.
3 min · http, quickstart
DNS tokens vs HTTP beacons
Pick DNS when you can plant a hostname; pick HTTP when you can plant a URL or file.
3 min · dns, http
How to test a MySQL dump honeytoken
The tripwire is DNS on SOURCE_HOST, not a MySQL listener on 3306. openssl/nc can alert via resolve. Import or dig match the real path.
5 min · mysql, dns, deployment
Why PDF honeytokens often do not fire (Preview, Gmail, Chrome)
PDF open-beacons only run in Adobe Acrobat/Reader. Preview, Gmail, and browser PDF viewers sandbox remote callbacks on purpose. Use HTML, Word, Excel, QR, or HTTP instead.
5 min · pdf, http, deployment
How to use Word and Excel honeytokens
Plant a .docx or .xlsx where office staff and thieves already look. Microsoft Word and Excel can alert on open. Pages, Google Docs, Numbers, and Sheets usually do not.
6 min · word, excel, http, deployment
Why Pages and Google Docs do not trip a Word honeytoken
Opening the .docx in Pages or Google Docs does not load Word's linked image. Use Microsoft Word, LibreOffice Writer, or the HTML download.
3 min · word, http, deployment
How supply chain honeytokens work (GitHub, Stripe, npm, PyPI, Docker)
These tokens look like real vendor credentials but detect via DNS when the planted hostname is resolved. Here is the mechanism, the best placement tactics, and how to test.
8 min · github, stripe, npm, dns, deployment
How to read a trigger without panicking
Source IP is often a resolver or scanner, not the human. Use exclusions for known-good noise.
3 min · alerts
Quiet the scanners, keep the incidents
Token and tenant exclusions still store the trigger. They only skip the notification.
2 min · alerts, ops
Get alerts into Slack, email, or a SIEM
Email is on by default once SMTP is set. Webhooks carry the same payload your SIEM can parse.
2 min · integrations
Forum, knowledge base, or a support ticket?
Public placement questions stay here. Account, billing, and broken tokens go to support.
1 min · community
What is safe to post in a public thread
Token type and a redacted screenshot are fine. Live URLs, keys, and customer names are not.
2 min · community, ops