I recently set up something called "canary tokens" (https://www.stationx.net/canarytokens/) to help detect if anyone is accessing files/emails/domains that I don't want to be accessed. They are meant to email you info about IP numbers anytime your file, email, link, URL is accessed so that you know if someone is accessing or trying to access your stuff.

One of the tokens is meant to "get [you] notified whenever someone opens browses a Windows directory in Explorer." I downloaded the zip file for that, extracted to my desktop and changed the folder name to something like: "Passwords and important files". Now I should get an email containing the time and the ip number every time the folder is opened.

I tried it a few times and noticed that I got an email but the emails didn't have the IP number I get when I google "what is my IP". Furthermore, I keep getting emails (while the laptop is on and connected to the wifi) every 2-10 minutes saying that a random IP has accessed the folder. The first Ip numbers were located in my city, but now most of them are from a different country. Some of them share all except the last two digits of the IP number.

Can anyone tell me what may be causing this and what I can do about it?

nb. I've also tried using this for links in email, urls on my domain, and Word files on my computer but those don't seem to make notifications so often and when I try accessing those, I get my IP number.


Just noticed that whenever I access the folder, the email reads:

Channel: HTTP

but when the unknown IP accesses the folder, the email reads:

Channel: DNS

Does that change anything?

  • Can you post some of the ip addresses that the canary email message is reporting?
    – 9Breaker
    Apr 26, 2018 at 3:35
  • Are you using a VPN?
    – A. Darwin
    Apr 26, 2018 at 8:08
  • @A.Darwin I'm using smartdnsproxy.com, but their live support tells me that those DNS addresses don't belong to them. But no VPN
    – Andri
    Apr 27, 2018 at 21:24
  • @9Breaker Google owned: - 302 direct media owned:
    – Andri
    Apr 27, 2018 at 21:25

1 Answer 1


Have you considered that an Antivirus Program or a Windows App may be accessing, uploading and inspecting your files on a remote server behind your knowledge?

What you've "uncovered" using canary tokens may lead to interesting findings regarding privacy issues on Window$. I'd start by knowing the owner of the IP address from where files are being accessed. This may give you leads about the programs accessing the files. From there, you may seek legal counseling, just make sure that you haven't agreed to what's happening by clicking "yes, yes, yes" while installing an app or accessing a website without fully understanding the terms and agreements.

I'm not a privacy expert, but I'm positive that in some part of the Microsoft Services Agreement there's a clause allowing MSFT to upload and inspect your files on a remote server.

"Some of them share all except the last two digits of the IP number".

Companies like GOOG, AMZN, MSFT or Dropbox own large IP address blocks. Find out the current owner of the IPA using ARIN, RIPE, LACNIC or APNIC.

  • 1
    Thanks for the answer. Some of the DNS addresses seem to be owned by Google and others are owned by 302 direct media. There are also some that seem to belong to my IPS, but even for those, I'm not sure why my computer should automatically be accessing that folder many times every hour. I created another similar folder that I put into another folder (Dropbox folder), which I assumed might be accessed every once in a while for syncing purposes, but that one has never been accessed automatically, only the one on my desktop.
    – Andri
    Apr 27, 2018 at 19:23
  • @Andri - You may need to conduct more tests with unique id's for each .zip file, this way, you'll be able to effectively know the who's, when's and possibly the how's. Apr 27, 2018 at 19:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .