Privacy Policy & Legitimate Interests Disclosure
This service operates an automated honeypot system for security monitoring, analyzing automated crawler behavior, and preserving network integrity.
---
1. What Data Is Collected
For each incoming HTTP request, the honeypot logs only the following factual, objective technical data points:
**Timestamp**: UTC timestamp in ISO 8601 format (e.g. `2026-09-17T14:32:11Z`).
**Hashed IP**: A one-way cryptographic SHA-256 digest calculated from the raw IP combined with a 24-hour daily salt (`SHA-256(Raw_IP + Daily_Salt)`).
**Subnet-Truncated Network**: The client IP address truncated to a subnet level (`/24` CIDR for IPv4 or `/48` CIDR for IPv6).
**Claimed User-Agent**: The raw `User-Agent` HTTP header string provided by the client, treated strictly as an unverified claim.
**Requested Path**: The HTTP URL path requested by the client.
**Robots.txt Rule**: The matching `robots.txt` directive applicable to the requested path (e.g. `Disallow: /admin`), or `none`.
**Response Code**: The integer HTTP response status code delivered (e.g. `200`).
**DeepSeek Classification**: A structured machine-learning behavioral evaluation containing:
- `behavior_pattern`: `mechanical`, `human_like`, or `unknown`
- `cadence_anomaly`: boolean flag
- `path_sequence_anomaly`: boolean flag
- `notes`: factual observations only (maximum 200 characters).
---
2. What Is NOT Collected
**Raw IP Addresses**: Raw IP addresses are **never stored on disk or in database records**. They are processed in volatile memory only long enough to calculate the subnet prefix and daily salted hash.
**Personal Identifiers**: No names, email addresses, phone numbers, or account details.
**Cookies**: No HTTP session cookies, tracking cookies, or local browser storage tokens.
**Request Bodies**: POST/PUT payloads, form submissions, or uploaded files are not recorded.
---
3. Lawful Basis
Data processing is conducted strictly under **Legitimate Interests** pursuant to **UK GDPR Article 6(1)(f)** and **EU GDPR Article 6(1)(f)** for security monitoring, protecting server infrastructure, and maintaining network integrity against unauthorized automated crawling and denial-of-service patterns.
---
4. Data Retention
**Public Log (`log:public:{YYYY-MM-DD}`)**: Retained for **24 hours** with automatic TTL expiration.
**Daily Salt (`salt:{YYYY-MM-DD}`)**: Maintained in Redis with a 24-hour TTL. A scheduled task automatically deletes yesterday's salt key daily at **00:05 UTC**, permanently preventing historic hashes from being reversed.
**Private Archive (`log:archive:{timestamp}:{uuid}`)**: Retained for **90 days** in an access-controlled namespace for longitudinal network telemetry analysis, after which entries are permanently expunged.
**Raw IP Retention**: **0 seconds** (never stored).
---
5. Factual Observation & Non-Accusatory Disclaimer
**Factual Observation Only**: All log entries are strict field/value technical records. The honeypot contains no judgment fields (such as threat scores, risk scores, malice ratings, or violation labels).
**No Implication of Malicious Intent**: Listings in this log do not imply malicious intent, wrongdoing, or policy violations.
**User-Agent Spoofing Notice**: User-Agent headers can be forged or spoofed by third parties. A `mismatch` verification status merely indicates that an incoming IP does not match the published IP ranges of the claimed vendor, which may be the result of header spoofing, intermediary proxies, or unlisted egress gateways.
---
6. How to Request a Correction or Removal
If you operate a crawler or network subnet and believe an IP prefix or vendor classification is inaccurate, or if you wish to request a correction or review under applicable data privacy rights:
**Contact Email**: `privacy@example.com` (or submit an issue to the project repository)
Please include:
1. The affected `/24` or `/48` network prefix.
2. The relevant UTC timestamp and date.
3. A link to your organization's official, publicly published IP range list.