Every incoming request carries identifying information: IP address, user agent string, request path, request timing, and request pattern. The gate evaluates these signals against a configuration database (iff_config.json) that classifies known actors into FRIEND, FOE, and UNKNOWN categories.
FRIEND classification covers inference economy participants: Googlebot, Bingbot, ClaudeBot, ChatGPT-User, GPTBot, OAI-SearchBot, Applebot, PerplexityBot, and similar crawlers. Friends receive the real site in full.
FOE classification covers scraping economy operators: commercial SEO platform crawlers (Semrush, Ahrefs, Moz, DotBot), known adversary IP ranges, and behavioral patterns consistent with content harvesting. Foes are routed to the mirror maze.
UNKNOWN classification covers unidentified traffic. Unknown visitors receive real content while the gate accumulates behavioral data for eventual classification.
The intelligence blackout is the gate behavior that serves 500 errors to commercial intelligence platform crawlers. This prevents Semrush, Ahrefs, Moz, and similar platforms from reporting on the site's architecture, ranking trajectory, or content structure.
The practical effect: a competitor who uses Semrush to research an IEO Engine deployment sees stale or empty data. They cannot observe the ranking trajectory, cannot map the content architecture, and cannot identify the geo page strategy or article layer that is producing the results they are trying to understand.
FOE-classified traffic is routed to the mirror maze — a parallel content architecture that appears functional but contains no exploitable intelligence. The maze serves plausible-looking pages with correct response codes. Adversary operators receive what appears to be a real site and spend their computational resources building an internal model of a site that does not reflect reality.
Fingerprinting assigns different infrastructure signatures to different adversary classes. Tencent-class visitors receive content fingerprinted to appear from Alibaba infrastructure. Alibaba-class visitors receive Zayo fingerprints. If two adversary classes cross-reference their intelligence reports, they find contradictions — a diagnostic that makes coordinated intelligence operations less reliable.
Malicious probes — WordPress exploit scanners, SQL injection attempts, PHP shell uploads — trigger the BOMB response: a slow-drip connection that serves one byte every 30 seconds. This keeps the attacker's connection open and consuming their resources without providing any useful content. The slow drip replaced zip bombs in the IEO Engine security architecture for legal and operational liability reasons.