3 min read · dns · http
DNS tokens vs HTTP beacons
Pick DNS when you can plant a hostname; pick HTTP when you can plant a URL or file.
DNS honeytokens shine in configs and dumps: a fake DATABASE_HOST, callback hostname in a SQL dump, or NS-delegated subdomain. Any resolver that looks the name up hits HorasEye authoritative DNS.
HTTP beacons shine in documents and pages: PDFs, QR codes, cloned websites, web images. The client has to fetch a URL.
One DNS probe often fans out across many resolver IPs (Cloudflare, Google, corporate recursive). HorasEye coalesces those into one alert window so you are not paged five times for one lookup.