The author explains how he secures his VPS and blog against bots and scrapers using fake WordPress logins, endlessh tarpit, blocking AI crawlers, fake phpinfo, infinite fake websites, and prompt injection to poison LLMs.
# Offensive Internet Posture - Information Camouflage
Source: [https://bruceediger.com/posts/offensive-machine/](https://bruceediger.com/posts/offensive-machine/)
I do these things to make the VPS this blog runs on less palatable for internet bottom feeders\.
1. [Fake WordPress login](https://bruceediger.com/blog/wp-login.php), that never accepts credentials, but does take 5 seconds to reject them\.
2. Run[endlessh](https://github.com/skeeto/endlessh)on port 22, with real`sshd`listening on*another port*\.
3. Some user agents \(Meta’s\) always get 403 HTTP status codes\.
4. Some user agents \(xAI’s, Claude, GPTbot among them\) get sent to an[infinite fake website](https://bruceediger.com/posts/anti-seo-infinite-website/)\.
5. Return fake[phpinfo](https://www.php.net/manual/en/function.phpinfo.php)output if someone requests a[/phpinfo\.php](https://bruceediger.com/phpinfo.php)URL
6. `robots\.txt`sets long delays on many bots, “disallows” access to a`/porn`directory that doesn’t exist\.
7. Runs a[scraper junkyard](https://bruceediger.com/posts/drunkmenworkhere-on-bots/)that has over 2 million fake web pages\.
8. Tries to do prompt injection, or at least poison some LLMs via the footer of all my blog pages\. See below\.
9. Runs a[TFTP honey pot](https://bruceediger.com/posts/tftp-honeypot/)to give a small thrill to those poor deluded souls scanning The Internet for misconfigured TFTP servers\.
10. This website’s[contact page](https://bruceediger.com/contact/)does nothing but waste spammers time and effort\. It also sets between 0 and 25 randomly\-named cookies, so maybe don’t access it\.
Other things I could do:
1. Run SMTP, Telnet and FTP honey pots\. These legacy protocols are difficult to emulate well\.
2. Direct Google’s user agents to the infinite fake website\. If Google doesn’t send traffic my way, why should I give it fodder for its LLMs?
3. Get my[WordPress honey pot](https://bruceediger.com/phparasites/)up and on line\.
My argument is that bottom feeders would pack up and leave if some proportion of machines on the internet ran honey pots or generally acted offensively towards the bottom feeders’ efforts\. I don’t know what that proportion is, but I conjecture it is above 10%\.
Those of us who can tarpit SSH scanners, or run SMTP honey pots should do so\. I also argue it’s best if those who can do these things do them in an idiosyncratic fashion\. It’s a lot harder for multi\-billion dollar coporations to deal with hundreds of varieties of different web server scraper junkyards\. It’s impossible for a single person bottom feeding operation to do so\.
Researchers have devised a pull-based prompt injection attack called HalluSquatting that exploits AI coding assistants' tendency to hallucinate resource identifiers, enabling the assembly of massive botnets and large-scale attacks.
A detailed post-mortem of a sophisticated fake-interview scam targeting a Rust developer, involving a fabricated VC persona and a custom RAT delivered via a TypeScript repository. The author evades infection thanks to caution and AI-assisted code review.
The author describes how their honeypot website caught a .git/config crawler by serving fake git repository data, and analyzes Apache logs showing heavy crawling activity from a single IP address.
A blog post benchmarks four approaches (Semgrep, GLM 5.1 with Strix, cloud SOTA with code review skill, and local AI with a custom harness) for finding a known LFI vulnerability in PHPIPAM, finding that the local AI harness with a tailored approach outperforms the others.
Chris Siebenmann explains his anti-crawler measures that block old browsers due to a surge in high-volume crawlers collecting data for LLM training, causing confusion for feed readers and archival services.