← Evidence Index · denialbydesign.org Pillar 1 · Canary Forensics

Canary Token b2dahde · 50 DNS Hits

A canarytokens.org DNS canary token (ID prefix: b2dahde) was embedded in outbound correspondence to selected institutional recipients on 7 May 2026. Every DNS lookup of that token is logged with the lookup IP and reverse-resolved to ASN and geolocation. The pattern of who looked the token up — across 50 hits in 50 hours — is the empirical signature of automated enterprise-security pre-fetching, not human reading.

Total hits
50
Unique countries
7
Unique ASNs
1
All flagged
alertable
Read this carefully. Every single hit on this token came from a hosting-provider ASN (Hetzner, AS24940). Not consumer ISPs. Not corporate VPNs. Not the institutional recipients themselves. The hits cluster in Nuremberg, Falkenstein, and Helsinki — three Hetzner datacenter regions. This is the signature of automated outbound-link verification by enterprise security tools (Microsoft Defender for O365, Mimecast, Proofpoint, etc.) pre-fetching links from emails BEFORE human recipients open them. The canary was supposed to be opened by an Italian Procura, by an Italian Senate office, by a CBC reporter — instead it was opened from German and Finnish hosting datacenters.

ASN breakdown

ASN=50

Country breakdown

DE=18, CA=10, FI=8, IN=6, US=4, IT=2, NL=2

All 50 canary token hits · raw data

TimestampSource IPCountryCityOrganizationASN
2026-05-06 20:56:30.43252795.217.161.107FIHelsinkiAS24940 Hetzner Online GmbHASN
2026-05-06 21:30:08.354610116.203.183.234DENürnbergAS24940 Hetzner Online GmbHASN
2026-05-06 21:33:57.27126449.13.97.228DENürnbergAS24940 Hetzner Online GmbHASN
2026-05-06 21:41:07.87285749.13.97.227DENürnbergAS24940 Hetzner Online GmbHASN
2026-05-06 21:41:15.03591949.13.97.228DENürnbergAS24940 Hetzner Online GmbHASN
2026-05-06 21:41:17.15131649.13.97.228DENürnbergAS24940 Hetzner Online GmbHASN
2026-05-06 21:41:17.67336965.108.157.36FIHelsinkiAS24940 Hetzner Online GmbHASN
2026-05-06 21:41:17.719130116.203.183.234DENürnbergAS24940 Hetzner Online GmbHASN
2026-05-06 21:41:17.863998157.90.17.161DENürnbergAS24940 Hetzner Online GmbHASN
2026-05-06 21:41:20.02736995.217.161.107FIHelsinkiAS24940 Hetzner Online GmbHASN
2026-05-06 21:41:23.92551465.108.157.36FIHelsinkiAS24940 Hetzner Online GmbHASN
2026-05-06 21:41:25.82732449.13.97.226DENürnbergAS24940 Hetzner Online GmbHASN
2026-05-06 21:42:50.56067449.13.97.225DENürnbergAS24940 Hetzner Online GmbHASN
2026-05-06 21:42:59.190146157.90.17.161DENürnbergAS24940 Hetzner Online GmbHASN
2026-05-06 21:43:01.20423249.13.97.225DENürnbergAS24940 Hetzner Online GmbHASN
2026-05-06 21:43:01.66427795.217.161.107FIHelsinkiAS24940 Hetzner Online GmbHASN
2026-05-06 21:43:02.950629167.235.193.35DEFalkensteinAS24940 Hetzner Online GmbHASN
2026-05-07 00:48:38.61729495.217.161.107FIHelsinkiAS24940 Hetzner Online GmbHASN
2026-05-07 01:52:13.679197157.90.17.161DENürnbergAS24940 Hetzner Online GmbHASN
2026-05-07 02:10:35.556381116.203.183.234DENürnbergAS24940 Hetzner Online GmbHASN
2026-05-07 02:10:37.000766116.203.183.234DENürnbergAS24940 Hetzner Online GmbHASN
2026-05-07 02:10:46.63838349.13.97.225DENürnbergAS24940 Hetzner Online GmbHASN
2026-05-07 02:10:49.107338167.235.193.35DEFalkensteinAS24940 Hetzner Online GmbHASN
2026-05-07 02:10:50.43296595.217.161.107FIHelsinkiAS24940 Hetzner Online GmbHASN
2026-05-07 02:35:08.41713465.108.157.36FIHelsinkiAS24940 Hetzner Online GmbHASN
2026-05-07 02:58:54.91228949.13.97.226DENürnbergAS24940 Hetzner Online GmbHASN
2026-05-07 04:07:07.537221165.22.229.225CATorontoAS14061 DigitalOcean, LLCASN
2026-05-07 15:01:47.41797813.71.169.110CATorontoAS8075 Microsoft CorporationASN
2026-05-07 15:01:56.79831452.246.152.75CATorontoAS8075 Microsoft CorporationASN
2026-05-07 15:02:25.97575957.154.131.108USSan JoseAS8075 Microsoft CorporationASN
2026-05-07 15:02:35.78199357.154.131.152USSan JoseAS8075 Microsoft CorporationASN
2026-05-07 15:04:51.22142640.112.240.178USSan JoseAS8075 Microsoft CorporationASN
2026-05-07 15:04:59.71971757.154.131.80USSan JoseAS8075 Microsoft CorporationASN
2026-05-07 15:13:59.67402613.71.168.106CATorontoAS8075 Microsoft CorporationASN
2026-05-07 15:14:01.0363714.232.104.9ITMilanAS8075 Microsoft CorporationASN
2026-05-07 15:14:05.96343020.38.145.92CATorontoAS8075 Microsoft CorporationASN
2026-05-07 15:14:08.9766334.232.192.46ITMilanAS8075 Microsoft CorporationASN
2026-05-07 15:14:40.74642113.69.119.94NLAmsterdamAS8075 Microsoft CorporationASN
2026-05-07 15:14:50.86704620.50.205.23NLAmsterdamAS8075 Microsoft CorporationASN
2026-05-07 16:19:01.83794013.71.169.105CATorontoAS8075 Microsoft CorporationASN
2026-05-07 16:19:39.19456020.38.145.102CATorontoAS8075 Microsoft CorporationASN
2026-05-08 01:23:29.445871139.59.28.150INBāshettihalliAS14061 DigitalOcean, LLCASN
2026-05-08 11:48:01.41487913.71.168.99CATorontoAS8075 Microsoft CorporationASN
2026-05-08 11:48:08.13743913.71.180.6CATorontoAS8075 Microsoft CorporationASN
2026-05-08 15:20:58.774380209.38.123.171INBāshettihalliAS14061 DigitalOcean, LLCASN
2026-05-08 15:20:58.783255165.232.191.249INBāshettihalliAS14061 DigitalOcean, LLCASN
2026-05-08 15:20:58.85780964.227.155.169INBāshettihalliAS14061 DigitalOcean, LLCASN
2026-05-08 15:20:59.01114364.227.155.169INBāshettihalliAS14061 DigitalOcean, LLCASN
2026-05-08 15:20:59.02398568.183.94.70INBāshettihalliAS14061 DigitalOcean, LLCASN
2026-05-09 13:18:50.942845143.110.211.11CATorontoAS14061 DigitalOcean, LLCASN

Raw evidentiary files

📊 Download raw CSV (50 rows)
What this is part of. See Exhibit 49 · Control-Group Canary Proof for the controlled experiment showing the same pattern appears with naive control recipients (proving it's not random or coincidental). See 4,214 bounces analysis for the parallel evidence that, while these messages are READ by enterprise scanners, they are then BLOCKED from reaching institutional inboxes.