🛰 Live Evidence — Who's Watching
Every probe, every surveillance touchpoint — captured, time-stamped, and on the record.
● LIVECanary tokensWebhook sensorsDNS logs
8,112Total Probes
1,078Unique IPs
201DOJ Range (149.101.x)
2.5%Federal %
How the canary works
When surveillance organizations probe the archive's published URLs, their visits are logged against our webhook and canary-token infrastructure. Every probe becomes part of the public evidence record. The watchers are being watched.
Notable captured probes
| Network range | Attribution | Significance |
|---|---|---|
149.101.0.0/16 | US Department of Justice | 198 first-contact hits in 24 hours following the Feb 21-23 2026 mass-email blast |
2601:582:c67c:7740::/64 | Comcast IPv6 · Loxahatchee Groves FL | 101 probes · Samsung SM-S918U device · documented residence of Glenn Dutton & William Lintz |
Cogeco Windsor | Windsor residential | Static IP · HeadlessChrome automation + manual follow-up · identifiable person in Windsor watching continuously |
Germany residential | Unknown | 54% of 5-day canary volume · either a journalist/supporter or commercial monitoring proxy |
Public JSONhooks
The archive provides read-only JSON endpoints so researchers, journalists, and the public can query the surveillance-probe log themselves:
GET /hooks/canary.json # aggregate stats
GET /hooks/canary/top-ips # top probing IPs
GET /hooks/canary/federal # federal-range probes
GET /hooks/canary/timeline # time-series