Visitor guide

Anything put on the internet is visited by bots within minutes. This zoo records who they are, and keeps a few of them busy.

Which gates are watched

The zoo itself, and the public front pages of a few other sites run from the same place. For those, the edge proxy mirrors a copy of each request to the zoo while the real site answers as usual; the zoo never sits in the path. Sites that need a login are not mirrored. Gates are shown under aliases, not hostnames.

How a visitor is identified

• The User-Agent decides the species and the enclosure. Unknown bots go to the Feral Pit, named after whatever gave them away.
• Bots that claim to be a search engine are checked with forward-confirmed reverse DNS. A "Googlebot" whose address does not resolve back to Google is stamped IMPOSTOR.
• A browser User-Agent that arrives without the headers every real browser sends, or that walks into the trap, is filed as a wolf in browser's clothing. People are counted, never described.
• Every response carries an X-Zoo-Species header saying what the zoo took the visitor for. No bot reads it. One day one will.

The stamps

OBEYED

Read robots.txt and stayed out of the trap.

MOSTLY

Read robots.txt, then went where it said not to.

FERAL

Never read robots.txt, walked straight in.

UNREAD

Has neither read the rules nor broken them.

TEMPTED

Followed the decoy sitemap into the maze.

HUNTING

Asks for .env files, admin panels and old PHP.

RETURNED

Took a fake secret away and came back to use it.

GENUINE

Reverse DNS confirms it is who it says.

The trap

/robots.txt forbids /trap/. /sitemap.xml lists forty-eight rooms inside it. Each page links to eight rooms one level deeper, the links are signed so depth cannot be faked, and the deeper a visitor goes the slower the rooms answer. Fetching robots.txt counts as reading the signs; entering the trap counts as ignoring them.

The secrets

Requests for /.env get a real-looking file with a fake API key, unique to the visitor's network. The key works on exactly one API, /api/, which is also forbidden in robots.txt and exists only to notice the key coming back. Everything else in the file decorates.

Privacy

Only the network (/24 for IPv4, /48 for IPv6) and a country are stored, never a full address. Browsers are counted but not described; their User-Agent is never kept.