Same here. More than half of my domains are used for email canaries. The other half are used as spam tarpits in addition to testing things as you mentioned.

Same here. More than half of my domains are used for email canaries. The other half are used as spam tarpits in addition to testing things as you mentioned. I have http on 3 of them and most of that usage is hidden wildcards using strict-SNI and not publicly accessible.