API sensor notes
API decoy traffic: 24–25 October 2026
· Jorge Aquino · Revision 2
The API decoy received 2,074 requests over 24 hours. Most runs contained one request. The published counts suggest that 11 longer runs generated most of the day’s traffic.
Data covers 24 October 2026 at 18:00 UTC through 25 October at 18:00 UTC, excluding the end time. The snapshot was published at 19:00:32 UTC. The counts below are saved with this post.
Request patterns
Most requests—1,255, or 60.5%—landed in “other request.” This category holds requests that do not match a more specific label. It does not identify what the client was trying to do.
| Category | Requests | Share |
|---|---|---|
| Other or unclassified requests | 1,255 | 60.5% |
| Configuration or repository probes | 679 | 32.7% |
| Application probes | 51 | 2.5% |
| Administration probes | 45 | 2.2% |
| Other API endpoints | 40 | 1.9% |
| API schema discovery | 2 | 0.1% |
| CMS probes | 2 | 0.1% |
| API authentication, data, and configuration categories | 0 | 0.0% |
Configuration and repository probes were the largest named category, with 679 requests. The API categories accounted for 42 requests: 40 to other API endpoints and two classified as schema discovery. There were no requests classified as API authentication, data-access, or configuration probes.
Configuration and repository probes were more visible than activity in the named API categories. The labels do not establish intent or identify which categories dominated the longer runs.
Request runs
Requests from the same source address are grouped into a run when no more than 30 minutes pass between them. This snapshot contained 140 runs. Most had just one request.
| Requests in a run | Runs | Share of runs |
|---|---|---|
| One | 94 | 67.1% |
| Two to four | 35 | 25.0% |
| Five or more | 11 | 7.9% |
The frozen snapshot gives run counts by size bucket. If every recorded request is included in those runs, the 94 single-request runs and 35 runs with two to four requests account for 164 to 234 requests combined. That leaves 1,840 to 1,910 requests (88.7% to 92.1%) in the 11 longer runs. The snapshot does not give exact per-run totals.
Of the 140 runs, 46 contained multiple requests, eight included a named API category, and 26 covered more than one category. These counts overlap: a run can belong to both groups. Crossing categories does not necessarily mean the client was exploring the API.
The published counts do not show request order or how a client reacted to a response. Shared addresses can group unrelated clients together, and the reporting cutoff can split a run. These are counting groups, not verified sessions or individual attackers.
Responses and client labels
GET accounted for 2,044 requests, or 98.6%. The decoy returned 105 responses in the 2xx range and 1,969 in the 4xx range. Because the decoy serves fixed responses, a 2xx status does not mean a client accessed real data or exploited anything.
Client labels come from User-Agent headers, which clients can set to any value. Here, 2,043 requests were labeled other or unrecognized, and 15 had no User-Agent. Those labels are not enough to identify the software or operator behind a request.
The public snapshot leaves out raw paths, query strings, bodies, credentials, and source addresses. The tables summarize categories; they do not reproduce individual requests.
Next comparison
A follow-up comparison would use separate 24-hour windows with the same category definitions and 30-minute gap. It would track configuration probes, the share of requests in longer runs, and how often runs cross categories.
The lack of recorded authentication or data-access probes says something about the traffic this decoy saw, not whether a real API would be secure.
Data and method
- Frozen public snapshot (JSON): the complete aggregate data used for this note, published at
2026-10-25T19:00:32Z. - Live API research endpoint: changes as new delayed snapshots are published.
- Threat Observatory: open the API activity view for current statistics.
Revision 2 adds the request concentration estimate from the original aggregate snapshot. Corrections or questions: contact@vardrsec.com.