{"slug": "offensive-internet-posture", "title": "Offensive Internet Posture", "summary": "Bruce Ediger, a software developer, describes the offensive security measures he deploys on his blog's VPS to deter malicious bots and scrapers, including a fake WordPress login, an endlessh tarpit on port 22, and serving 403 errors to Meta's user agents. He also sends AI crawlers from xAI, Claude, and GPTBot to an infinite fake website, maintains a scraper junkyard with over 2 million fake pages, and attempts prompt injection via blog footers. Ediger argues that if more than 10% of internet machines ran honeypots or acted offensively, bottom feeders would leave, and encourages idiosyncratic implementations to complicate evasion.", "body_md": "# Offensive Internet Posture\n\nI do these things to make the VPS this blog runs on less palatable for internet bottom feeders.\n\n[Fake WordPress login](/blog/wp-login.php), that never accepts credentials, but does take 5 seconds to reject them.- Run\n[endlessh](https://github.com/skeeto/endlessh)on port 22, with real`sshd`\n\nlistening on*another port*. - Some user agents (Meta’s) always get 403 HTTP status codes.\n- Some user agents (xAI’s, Claude, GPTbot among them)\nget sent to an\n[infinite fake website](https://bruceediger.com/posts/anti-seo-infinite-website/). - Return fake\n[phpinfo](https://www.php.net/manual/en/function.phpinfo.php)output if someone requests a[/phpinfo.php](/phpinfo.php)URL `robots.txt`\n\nsets long delays on many bots, “disallows” access to a`/porn`\n\ndirectory that doesn’t exist.- Runs a\n[scraper junkyard](https://bruceediger.com/posts/drunkmenworkhere-on-bots/)that has over 2 million fake web pages. - Tries to do prompt injection, or at least poison some LLMs via the footer of all my blog pages. See below.\n- Runs a\n[TFTP honey pot](https://bruceediger.com/posts/tftp-honeypot/)to give a small thrill to those poor deluded souls scanning The Internet for misconfigured TFTP servers. - This website’s\n[contact page](/contact/)does nothing but waste spammers time and effort. It also sets between 0 and 25 randomly-named cookies, so maybe don’t access it.\n\nOther things I could do:\n\n- Run SMTP, Telnet and FTP honey pots. These legacy protocols are difficult to emulate well.\n- Direct Google’s user agents to the infinite fake website. If Google doesn’t send traffic my way, why should I give it fodder for its LLMs?\n- Get my\n[WordPress honey pot](/phparasites/)up and on line.\n\nMy argument is that bottom feeders would pack up and leave if some proportion of machines on the internet ran honey pots or generally acted offensively towards the bottom feeders’ efforts. I don’t know what that proportion is, but I conjecture it is above 10%.\n\nThose of us who can tarpit SSH scanners, or run SMTP honey pots should do so. I also argue it’s best if those who can do these things do them in an idiosyncratic fashion. It’s a lot harder for multi-billion dollar coporations to deal with hundreds of varieties of different web server scraper junkyards. It’s impossible for a single person bottom feeding operation to do so.", "url": "https://wpnews.pro/news/offensive-internet-posture", "canonical_source": "https://bruceediger.com/posts/offensive-machine/", "published_at": "2026-08-05 12:34:15+00:00", "updated_at": "2026-08-05 13:40:12.629947+00:00", "lang": "en", "topics": ["ai-ethics", "ai-agents"], "entities": ["Bruce Ediger", "Meta", "xAI", "Claude", "GPTBot", "WordPress", "endlessh", "TFTP"], "alternates": {"html": "https://wpnews.pro/news/offensive-internet-posture", "markdown": "https://wpnews.pro/news/offensive-internet-posture.md", "text": "https://wpnews.pro/news/offensive-internet-posture.txt", "jsonld": "https://wpnews.pro/news/offensive-internet-posture.jsonld"}}