Offensive Internet Posture

Bruce Ediger, a software developer, describes the offensive security measures he deploys on his blog's VPS to deter malicious bots and scrapers, including a fake WordPress login, an endlessh tarpit on port 22, and serving 403 errors to Meta's user agents. He also sends AI crawlers from xAI, Claude, and GPTBot to an infinite fake website, maintains a scraper junkyard with over 2 million fake pages, and attempts prompt injection via blog footers. Ediger argues that if more than 10% of internet machines ran honeypots or acted offensively, bottom feeders would leave, and encourages idiosyncratic implementations to complicate evasion.

Offensive Internet Posture I do these things to make the VPS this blog runs on less palatable for internet bottom feeders. Fake WordPress login /blog/wp-login.php , that never accepts credentials, but does take 5 seconds to reject them.- Run endlessh https://github.com/skeeto/endlessh on port 22, with real sshd listening on another port . - Some user agents Meta’s always get 403 HTTP status codes. - Some user agents xAI’s, Claude, GPTbot among them get sent to an infinite fake website https://bruceediger.com/posts/anti-seo-infinite-website/ . - Return fake phpinfo https://www.php.net/manual/en/function.phpinfo.php output if someone requests a /phpinfo.php /phpinfo.php URL robots.txt sets long delays on many bots, “disallows” access to a /porn directory that doesn’t exist.- Runs a scraper junkyard https://bruceediger.com/posts/drunkmenworkhere-on-bots/ that has over 2 million fake web pages. - Tries to do prompt injection, or at least poison some LLMs via the footer of all my blog pages. See below. - Runs a TFTP honey pot https://bruceediger.com/posts/tftp-honeypot/ to give a small thrill to those poor deluded souls scanning The Internet for misconfigured TFTP servers. - This website’s contact page /contact/ does nothing but waste spammers time and effort. It also sets between 0 and 25 randomly-named cookies, so maybe don’t access it. Other things I could do: - Run SMTP, Telnet and FTP honey pots. These legacy protocols are difficult to emulate well. - Direct Google’s user agents to the infinite fake website. If Google doesn’t send traffic my way, why should I give it fodder for its LLMs? - Get my WordPress honey pot /phparasites/ up and on line. My argument is that bottom feeders would pack up and leave if some proportion of machines on the internet ran honey pots or generally acted offensively towards the bottom feeders’ efforts. I don’t know what that proportion is, but I conjecture it is above 10%. Those of us who can tarpit SSH scanners, or run SMTP honey pots should do so. I also argue it’s best if those who can do these things do them in an idiosyncratic fashion. It’s a lot harder for multi-billion dollar coporations to deal with hundreds of varieties of different web server scraper junkyards. It’s impossible for a single person bottom feeding operation to do so.