cd /news/ai-ethics/offensive-internet-posture · home topics ai-ethics article
[ARTICLE · art-87690] src=bruceediger.com ↗ pub= topic=ai-ethics verified=true sentiment=· neutral

Offensive Internet Posture

Bruce Ediger, a software developer, describes the offensive security measures he deploys on his blog's VPS to deter malicious bots and scrapers, including a fake WordPress login, an endlessh tarpit on port 22, and serving 403 errors to Meta's user agents. He also sends AI crawlers from xAI, Claude, and GPTBot to an infinite fake website, maintains a scraper junkyard with over 2 million fake pages, and attempts prompt injection via blog footers. Ediger argues that if more than 10% of internet machines ran honeypots or acted offensively, bottom feeders would leave, and encourages idiosyncratic implementations to complicate evasion.

read2 min views1 publishedAug 5, 2026

I do these things to make the VPS this blog runs on less palatable for internet bottom feeders.

Fake WordPress login, that never accepts credentials, but does take 5 seconds to reject them.- Run

endlesshon port 22, with realsshd listening onanother port. - Some user agents (Meta’s) always get 403 HTTP status codes.

  • Some user agents (xAI’s, Claude, GPTbot among them) get sent to an
[infinite fake website](https://bruceediger.com/posts/anti-seo-infinite-website/). - Return fake
[phpinfo](https://www.php.net/manual/en/function.phpinfo.php)output if someone requests a[/phpinfo.php](/phpinfo.php)URL `robots.txt`

sets long delays on many bots, “disallows” access to a/porn

directory that doesn’t exist.- Runs a scraper junkyardthat has over 2 million fake web pages. - Tries to do prompt injection, or at least poison some LLMs via the footer of all my blog pages. See below.

  • Runs a TFTP honey potto give a small thrill to those poor deluded souls scanning The Internet for misconfigured TFTP servers. - This website’s contact pagedoes nothing but waste spammers time and effort. It also sets between 0 and 25 randomly-named cookies, so maybe don’t access it.

Other things I could do:

  • Run SMTP, Telnet and FTP honey pots. These legacy protocols are difficult to emulate well.
  • Direct Google’s user agents to the infinite fake website. If Google doesn’t send traffic my way, why should I give it fodder for its LLMs?
  • Get my

WordPress honey potup and on line. My argument is that bottom feeders would pack up and leave if some proportion of machines on the internet ran honey pots or generally acted offensively towards the bottom feeders’ efforts. I don’t know what that proportion is, but I conjecture it is above 10%.

Those of us who can tarpit SSH scanners, or run SMTP honey pots should do so. I also argue it’s best if those who can do these things do them in an idiosyncratic fashion. It’s a lot harder for multi-billion dollar coporations to deal with hundreds of varieties of different web server scraper junkyards. It’s impossible for a single person bottom feeding operation to do so.

── more in #ai-ethics 4 stories · sorted by recency
── more on @bruce ediger 3 stories trending now
sponsored brought to you by zahid.host 4,200+ EU-deployed projects
reading about agents? ship yours in a single git push.

Run your AI side-project on zahid.host

EU-based hosting, git-push deploys, automatic HTTPS, no cold starts. Free tier with a custom domain — perfect for shipping the agent you just read about.

$git push zahid main
Live at https://your-agent.zahid.host
Get free account → Pricing
from €0/mo · no card required
LIVE [news/offensive-internet-p…] indexed:0 read:2min 2026-08-05 ·