# WebDecoy

WebDecoy는 Vercel 사이트 또는 앱에 유입되는 자동화 트래픽을 모니터링해 크롤러, AI 봇, 도구, user agent가 없는 요청을 식별합니다. 공개된 IP 범위 또는 서명된 요청을 검증하고, 위조된 유명 user agent를 표시하며, 지원되는 Vercel 요금제에서 애플리케이션 코드를 변경하지 않고 활동을 보고합니다.

- Findings24: <https://findings24.com/ko/tools/webdecoy>
- 웹사이트: <https://webdecoy.dev>
- 가격: Freemium
- 카테고리: Developer Tools

## WebDecoy란 무엇인가요?

WebDecoy is a monitoring tool for identifying automated traffic that reaches a Vercel site or application. It observes requests that conventional analytics may miss, including crawlers that do not execute JavaScript, and distinguishes reported crawler identities from requests that may be spoofing a known user agent.

For Vercel projects, connecting WebDecoy creates a log drain so the service can analyze request-level data without a code change or redeploy. On Vercel Hobby teams, the alternative is a line of `@webdecoy/next` middleware. WebDecoy is monitoring-only: it does not block or challenge requests.

## WebDecoy(으)로 무엇을 할 수 있나요?

### Request-level crawler visibility

Reports crawlers, tools, and requests with no user agent based on traffic received by the site, including automated visitors that browser-based analytics may not capture.

### Identity verification

Verifies crawlers that publish IP ranges or sign their requests, helping distinguish claimed identities from observed request characteristics.

### Spoofing flags

Flags requests that appear to forge a well-known user agent rather than treating every matching user-agent string as verified.

### Vercel log-drain setup

Connecting a project creates a Vercel log drain and sends request data such as user agent, path, status, client IP, and TLS fingerprint to WebDecoy.

### No-redeploy monitoring setup

The Vercel connection does not require an application code change or redeploy. It also creates three environment variables used by the optional Next.js middleware.

### Project cleanup

Disconnecting a project removes its WebDecoy log drain and the three variables created by the integration; disconnecting the integration removes everything it set up.

## 사용 사례

### Audit AI and crawler traffic

Site owners can see which automated agents are reaching their Vercel site, including agents invisible to JavaScript analytics.

### Investigate questionable bot identities

Teams can review verification results and spoofing flags when a request claims to be a recognized crawler or bot.

### Monitor traffic without application changes

Vercel Pro or Enterprise teams can connect a project and use the log-drain workflow without modifying application code or redeploying.

### Monitor a Hobby project with middleware

Hobby users can use the documented \`@webdecoy/next\` middleware path when a Vercel log drain is unavailable to their team plan.

## 자주 묻는 질문

### What traffic does WebDecoy report?

It reports crawlers, tools, and requests with no user agent. Human visitors are not reported.

### How does WebDecoy verify a crawler?

It verifies crawlers that publish their IP ranges or sign their requests, and flags requests that appear to forge a well-known user agent.

### Does connecting a Vercel project require code changes?

For projects using the Vercel log-drain connection, WebDecoy sets up the drain without a code change or redeploy. On Hobby, the documented alternative is to add one line of \`@webdecoy/next\` middleware.

### Which Vercel plans support the log-drain setup?

The listing states that drains require a Pro or Enterprise team. Vercel’s pricing page lists Hobby as a free plan, Pro at $20 per month, and Enterprise as a custom plan; these are Vercel plan prices, not stated WebDecoy prices.

### Does WebDecoy block or challenge bots?

No. It is for monitoring only and never blocks or challenges a request.

## 주요 정보

- **Category**: Security monitoring
- **Platform**: Vercel
- **Traffic scope**: Crawlers, tools, and requests with no user agent
- **Vercel workflow**: Log drain for Pro and Enterprise teams
- **Hobby workflow**: \`@webdecoy/next\` middleware
- **Reported request data**: User agent, path, status, client IP, and TLS fingerprint