Glossary
Complete definitions of terms used throughout the WebDecoy documentation.
A Record
Section titled “A Record”A DNS record type that maps a domain name directly to an IPv4 address. In WebDecoy, A records point to the static IP 3.130.2.51.
Automated Certificate Management Environment. The protocol used by Let’s Encrypt to issue and renew SSL/TLS certificates automatically.
API Key
Section titled “API Key”A secret token used to authenticate programmatic access to the WebDecoy API. Format: sk_live_xxxxx.
Attack Signature
Section titled “Attack Signature”A pattern in request data that indicates a known attack type, such as SQL injection or XSS.
The third-party authentication service WebDecoy uses for user login and identity management.
Any automated software that accesses websites or APIs. Can be legitimate (search engines) or malicious (scrapers, attackers).
Bot Scanner
Section titled “Bot Scanner”A JavaScript-based detection system that runs in visitors’ browsers to identify automation and bots.
Bot Score
Section titled “Bot Score”A 0-100 score indicating the likelihood that a visitor is automated rather than human.
Challenge
Section titled “Challenge”An interactive test (like CAPTCHA) presented to visitors suspected of being bots.
CNAME Record
Section titled “CNAME Record”A DNS record type that creates an alias from one domain name to another. Used as an alternative to A records for custom domains.
Confidence Level
Section titled “Confidence Level”How certain WebDecoy is about a detection or classification. Values: High, Medium, Low.
Crawler
Section titled “Crawler”A bot that systematically browses websites, typically to index content (like search engines).
Custom Domain
Section titled “Custom Domain”A domain you own and configure to serve WebDecoy decoy content, making honeypots appear as part of your infrastructure.
Dashboard
Section titled “Dashboard”The main WebDecoy web interface where you view detections, manage resources, and configure settings.
A honeypot resource (link, endpoint, or form field) designed to catch attackers and bots. Legitimate users never access decoys.
Decoy Link
Section titled “Decoy Link”A hidden URL that triggers a detection when accessed. Also called a honeypot link.
Detection
Section titled “Detection”A recorded event when someone interacts with a decoy or triggers bot detection. Contains full request details and threat assessment.
Domain Name System. The internet’s system for translating domain names to IP addresses.
Endpoint Decoy
Section titled “Endpoint Decoy”A fake API endpoint that captures detailed request information including POST bodies and attack patterns.
False Positive
Section titled “False Positive”When legitimate traffic is incorrectly flagged as malicious.
Fingerprinting
Section titled “Fingerprinting”Collecting browser characteristics (canvas, WebGL, fonts) to create a unique identifier for tracking and anomaly detection.
The process of determining geographic location from an IP address.
Good Bot
Section titled “Good Bot”A legitimate automated crawler like Googlebot or social media preview fetchers.
Headless Browser
Section titled “Headless Browser”A web browser running without a graphical interface, commonly used for automation and by attackers.
Honeypot
Section titled “Honeypot”A security resource designed to detect, deflect, or study unauthorized access attempts. Decoys are a type of honeypot.
Ingest Service
Section titled “Ingest Service”The WebDecoy backend component that receives decoy interactions and processes detections in real-time.
Integration
Section titled “Integration”A connection to a third-party service like Cloudflare, Slack, or Datadog for automated actions or notifications.
IP Reputation
Section titled “IP Reputation”A score indicating whether an IP address has been associated with malicious activity.
JA3/JA4
Section titled “JA3/JA4”TLS fingerprinting methods that create a hash from the TLS handshake, useful for identifying automated tools.
Let’s Encrypt
Section titled “Let’s Encrypt”A free, automated certificate authority that provides SSL/TLS certificates. WebDecoy uses Let’s Encrypt for custom domain HTTPS.
MITRE ATT&CK
Section titled “MITRE ATT&CK”A globally recognized framework of adversary tactics and techniques, used to classify detected behaviors.
Multi-tenancy
Section titled “Multi-tenancy”An architecture where a single instance serves multiple customers (organizations) with data isolation.
Organization
Section titled “Organization”The top-level container in WebDecoy. All resources belong to an organization, which is also the billing unit.
Poison
Section titled “Poison”A decoy action that returns fake or misleading data to waste attacker time.
Property
Section titled “Property”A logical grouping within an organization for organizing related resources (e.g., different websites or environments).
A server that acts as an intermediary for requests. Detected as a risk indicator when used for anonymization.
Rate Limiting
Section titled “Rate Limiting”Restricting the number of requests a client can make within a time period.
Reconnaissance
Section titled “Reconnaissance”The first phase of an attack where adversaries gather information about the target. MITRE ATT&CK tactic TA0043.
Scanner
Section titled “Scanner”Automated tools that probe systems for vulnerabilities.
The permissions assigned to an API key, limiting what actions it can perform.
Scraper
Section titled “Scraper”A bot that extracts content from websites, often without permission.
Sensitivity
Section titled “Sensitivity”A configuration setting that determines how strictly the detection system scores visitors.
Server Name Indication. A TLS extension that allows multiple SSL certificates on a single IP address.
SSL/TLS
Section titled “SSL/TLS”Protocols for encrypting communication between browsers and servers. “SSL” often refers to both SSL and its successor TLS.
Stripe
Section titled “Stripe”The payment processing service WebDecoy uses for subscription billing.
Threat Level
Section titled “Threat Level”A classification based on threat score: MINIMAL, LOW, MEDIUM, HIGH, or CRITICAL.
Threat Score
Section titled “Threat Score”A unified 0-100 score combining multiple signals into a single risk assessment.
The Onion Router. An anonymity network that can be used to hide the source of web traffic.
Trigger Action
Section titled “Trigger Action”What happens when a decoy is accessed: Log, Block, Poison, or Redirect.
Unified Score
Section titled “Unified Score”See “Threat Score.”
User Agent
Section titled “User Agent”An HTTP header identifying the client software making a request.
Virtual Private Network. Can be detected as a risk indicator when used for anonymization.
Web Application Firewall. A security system that filters HTTP traffic to protect web applications.
Webhook
Section titled “Webhook”A mechanism for one system to notify another of events via HTTP requests.
WebDriver
Section titled “WebDriver”A browser automation interface used by tools like Selenium. Detected as an automation indicator.