Would depend on the method. For the ones that are automated like opening a PDF - I doubt many attackers will bother blacklisting the domain in their DNS.

But for the manual ones, like opening a link - it'd probably be better to host them at a much less suspicious sounding domain.

> Do you think any one in practice will be watching for this domain?

I would bet money that multiple governments already do.

Hmm, why? It seems like another risk to let people mark urls as 'please do not read' and respect it

An easier service would be if canarytokens.org allowed us to CNAME our a subdomain of our company, so the token would be sent to hj.example.com. But that would make canarytoken.org a public service, which requires funding.

You totally can?