Cool idea!

I immediately thought of a concern which is already highlighted in their FAQ:

> What if attackers blacklist the canarytokens.org domain? Doesn’t that work?

> This would work! That’s why we suggest that you download the canarytokens docker image and run your own server. (You can grab the source to build it yourself from here)

This seems like something that could be highlighted more prominently, since the main site makes it so extremely convenient to use a hosted token (where some knowledgeable attackers can avoid triggering the canary).