Decoy Sink Endpoint¶
Interface — instantiates Nonactivating Occupancy Blockade
Provides a nonproductive endpoint or route that absorbs unwanted requests without executing the protected function.
A Decoy Sink Endpoint stands up an attractive-looking but nonproductive destination — a fake login, an unused-looking API route, a trap address, a service that accepts and discards — positioned exactly where an adversary goes looking for the real function, so their probing and attack traffic lands on the decoy instead of on the protected system. The sink accepts the request and does nothing productive: no privileged action, no real data, often a slow, resource-wasting non-answer. Its defining property, and what separates it from every user-facing hold, is that it is adversary-facing: it exists to be found and occupied by the unwanted activator, absorbing and diverting hostile requests away from the recognition site that actually matters.
Example¶
A platform team runs a public API and is tired of credential-stuffing bots hammering the real /login. They deploy a decoy: a plausible-looking /admin and a second login host that no legitimate user or documented client ever touches. Real users are routed to the genuine service; anything that reaches the decoy is, by construction, either a scanner or an attacker. The decoy accepts submissions and returns slow, deliberately dragged-out non-responses — it never authenticates anyone and holds no real accounts — so the bots burn time and connections against a route that leads nowhere.
Because the decoy is only useful while it is convincing, the team profiles how attackers actually search — which paths they probe, which user-agents and timing signatures they use — and shapes the decoy to match. They watch for the attackers who notice the trap and pivot to the real endpoints (a bypass), and they watch for the decoy being ignored or, worse, saturated to the point of becoming a liability. The outcome is hostile traffic absorbed away from the protected function, plus a live read on adversary behavior.
How it works¶
- Expose an inviting nonproductive route. Present a destination the adversary wants, positioned where they will find it before the real one.
- Perform nothing protected. The sink accepts and discards — no authentication, no data, no privileged action — so occupying it yields the attacker nothing.
- Shape it to the adversary. Model how attackers search and make the decoy match, or it will be skipped.
- Watch for bypass and displacement. Detect attackers who route around the decoy to the real site, and detect a decoy that is ignored, saturated, or turned into a foothold.
Tuning parameters¶
- Attractiveness / realism — how convincingly the decoy resembles the real target; higher realism absorbs more traffic but costs more to maintain and risks looking too central.
- Resource drain — how much a tarpit-style sink slows the attacker; more drain wastes their effort but also consumes your own capacity.
- Isolation — how strictly the sink is walled off from real assets; strong isolation is essential, because a decoy that shares a path with production is a liability, not a defense.
- Breadth — how many decoy routes you stand up; more coverage catches more probing but multiplies monitoring and upkeep.
When it helps, and when it misleads¶
Its strength is that it both absorbs and reveals: hostile traffic is diverted from the protected function, and the sink doubles as an early-warning sensor on who is attacking and how.[n1] It fits situations where an adversary is actively hunting for a recognition site and you can offer them a convincing dead end.
It misleads in two ways. A decoy that is distinguishable from the real thing is simply ignored — the attacker bypasses to the true endpoint and the sink gives false comfort. And a sink that is not truly inert or truly isolated can be turned into a foothold, or drift into entrapment and surveillance that outruns its legitimate purpose. The classic misuse is a honeypot stood up without strict isolation, which an attacker compromises and pivots from. The guarding discipline is strict isolation, active bypass monitoring, and keeping the decoy proportionate and defensible rather than a covert dragnet.
How it implements the components¶
unwanted_activator_profile— the decoy is built around how the adversary searches and what it targets; without that profile it is not convincing.nonactivating_blocker— the sink is the inert occupant of the site the attacker seeks: it answers but performs no protected function.abuse_and_bypass_watch— monitors adversaries who detect the decoy and route around it to the real endpoints.displacement_monitor— detects when the decoy is ignored, saturated, or subverted into a liability.
It builds no recognition_site_model of a legitimate user's action path, offers no legitimate_access_exception, and applies no release_and_clearance_rule to a parked action — those define Confirmation Interstitial Hold, its nearest twin, which faces a genuine user about to make a mistake rather than an adversary probing for a way in.
Related¶
- Instantiates: Nonactivating Occupancy Blockade — supplies the adversary-facing, absorb-and-divert variant of the pattern.
- Sibling mechanisms: Competitive Receptor Antagonist · Active-Site Inhibitor · Defensive Identifier Reservation · Mutex or Lock Token · Maintenance Hold or Dummy Slot · Confirmation Interstitial Hold · Precommitment Blocker
Editorial Notes¶
Form Classification¶
Form family: Control, Automation & Runtime
Rationale: The endpoint receives and discards unwanted requests without authentication, data, or privileged action while detecting bypass, saturation, or misuse, so its operative form is runtime diversion control.
Nearest alternative: Interface, Display & Cue — The endpoint presents an attractive surface to an adversary, but its defining work is technical request absorption and route protection rather than a user-facing control.
Review outcome: Adjudicated after independent review; high confidence.
Origin Attribution¶
Primary origin: Security Studies & Intelligence Analysis
Origin pattern: Single lineage
Present-day reach: Specialized
Rationale: Cybersecurity cohered honeypots, tarpits, trap addresses, and fake service endpoints that attract, absorb, and observe hostile requests away from protected functions.
Related originating lineages:
- Computer Science & Software Engineering — Network and service engineering supplied isolated nonproductive endpoints and safe request handling.
Review resolution: Cybersecurity cohered honeypots, tarpits, trap addresses, and fake service endpoints that attract, absorb, and observe hostile requests away from protected functions.
Review outcome: Reconciled after independent review; high confidence.
Notes¶
[n1] Tarpit — a service that deliberately responds very slowly to unwanted (often automated) connections, holding them open to waste the attacker's time and resources rather than rejecting them outright. A relative of the honeypot, which is a decoy resource made attractive to attackers so their activity can be absorbed and observed away from real systems. ↩