I do these things to make the VPS this blog runs on less palatable for internet bottom feeders.

  1. Fake WordPress login, that never accepts credentials, but does take 5 seconds to reject them.
  2. Run endlessh on port 22, with real sshd listening on another port.
  3. Some user agents (Meta’s) always get 403 HTTP status codes.
  4. Some user agents (xAI’s, Claude, GPTbot among them) get sent to an infinite fake website.
  5. Return fake phpinfo output if someone requests a /phpinfo.php URL
  6. robots.txt sets long delays on many bots, “disallows” access to a /porn directory that doesn’t exist.
  7. Runs a scraper junkyard that has over 2 million fake web pages.
  8. Tries to do prompt injection, or at least poison some LLMs via the footer of all my blog pages. See below.
  9. Runs a TFTP honey pot to give a small thrill to those poor deluded souls scanning The Internet for misconfigured TFTP servers.
  10. This website’s contact page does nothing but waste spammers time and effort. It also sets between 0 and 25 randomly-named cookies, so maybe don’t access it.

Other things I could do:

  1. Run SMTP, Telnet and FTP honey pots. These legacy protocols are difficult to emulate well.
  2. Direct Google’s user agents to the infinite fake website. If Google doesn’t send traffic my way, why should I give it fodder for its LLMs?
  3. Get my WordPress honey pot up and on line.

My argument is that bottom feeders would pack up and leave if some proportion of machines on the internet ran honey pots or generally acted offensively towards the bottom feeders’ efforts. I don’t know what that proportion is, but I conjecture it is above 10%.

Those of us who can tarpit SSH scanners, or run SMTP honey pots should do so. I also argue it’s best if those who can do these things do them in an idiosyncratic fashion. It’s a lot harder for multi-billion dollar coporations to deal with hundreds of varieties of different web server scraper junkyards. It’s impossible for a single person bottom feeding operation to do so.