--- title: Offensive Internet Posture | daily.dev description: A sysadmin shares a collection of adversarial techniques deployed on a personal VPS to frustrate internet bots, scrapers, and AI crawlers. Tactics include a... canonical: https://daily.dev/posts/offensive-internet-posture-bsqoqnut6 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Offensive Internet Posture | daily.dev og:description: A sysadmin shares a collection of adversarial techniques deployed on a personal VPS to frustrate internet bots, scrapers, and AI crawlers. Tactics include a... og:url: https://daily.dev/posts/offensive-internet-posture-bsqoqnut6 og:image: https://api.daily.dev/og/posts/bSqoQNut6.png og:image:alt: Offensive Internet Posture og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Offensive Internet Posture **[Lobsters](https://daily.dev/sources/lobsters)** · 2 min read · 0 upvotes · 0 comments ## Summary A sysadmin shares a collection of adversarial techniques deployed on a personal VPS to frustrate internet bots, scrapers, and AI crawlers. Tactics include a fake WordPress login with deliberate delays, running endlessh on port 22, returning fake phpinfo output, sending AI crawlers to an infinite fake website, a scraper junkyard with 2 million fake pages, a TFTP honeypot, a contact form that wastes spammers' time, and prompt injection attempts via page footers. The author argues that if even 10% of internet-connected machines adopted such offensive postures, it would make bot operations economically unviable. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is endlessh and how is it used to defend against SSH scanners? Endlessh is a tool that runs on port 22 as a tarpit, sending extremely slow, endless SSH banner data to scanners while never completing the handshake, wasting their time and resources. The real sshd is moved to run on a different, non-standard port so legitimate access still works while automated scanners get stuck on the fake service. _Developers hardening internet-facing servers can find similar defensive tactics discussed on daily.dev._ ### How can website operators poison or block AI crawlers like GPTbot and Claude's bot? One approach is redirecting specific user agents, including xAI's, Claude's, and GPTbot, to an infinite fake website that endlessly generates junk pages, wasting crawler resources instead of serving real content. Another tactic embeds prompt injection or poisoning text in page footers, aiming to corrupt the data these bots feed into their language models. _Site owners deciding how to respond to AI scraping traffic can track emerging countermeasures on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 2 discussions and 18 comments across hackernews, lobsters (as of 2026-09-14). **TL;DR:** Commenters find the project creative and relatable, but the more technically experienced among them are skeptical that most of these countermeasures meaningfully affect well-engineered crawlers, which are already hardened against exactly these tactics. **Sentiment:** 55% positive · 35% mixed · 10% skeptical **The case for** - The fake WordPress login, endlessh tarpit, and infinite fake website are entertaining and at least impose some cost on unsophisticated bots. - Moving content to obscure protocols like Gopher is noted as a genuinely effective way to keep scrapers away from specific resources. - Blocking clients that don't support modern features (brotli, HTTP/2) may serve as a useful congruence test to distinguish fake browsers from real ones. **The pushback** - Well-built crawlers already handle zip bombs, tarpits, and slow responses gracefully because normal web content forces them to impose time and size limits anyway. - Tarpits can backfire by keeping crawler connections alive longer than desired, harming the host more than the bot. - The contact form honeypot is linked in the site's nav bar, potentially trapping real human visitors alongside spammers. - Simply serving a default nginx index page may be more effective than elaborate countermeasures, since crawlers finding nothing interesting tend to move on. **By community** - hackernews (mixed): Only a single low-signal comment was present, offering no substantive take. - lobsters (mixed): Commenters appreciate the creativity and share similar experiments, but a knowledgeable crawler author explains in detail why most of these tactics don't meaningfully affect serious crawlers. **Hottest debate:** Whether countermeasures like zip bombs and tarpits actually impose meaningful costs on real-world crawlers, or whether crawlers are already immune by necessity of handling ordinary large web content. **Open questions** - Would widespread adoption of these techniques actually make bot operations economically unviable, or would crawler operators simply adapt faster than individual sysadmins can innovate? - Are there countermeasures that genuinely work against well-engineered, resource-limited crawlers rather than only tripping up naive ones? **Highlights** > I'm the author. Meta does not do rate limiting well, so the number of requests from Meta went up and up and up. The same was true of Bytespider, which I believe is Bytedance's (TikTok) crawler. I'm running a $6.47 a month VPS, it couldn't handle all of Meta and all of Bytedance. Claude and GPTbot seem to do rate limiting of some sort on the same fake data. I haven't had a legit contact form response ever. I don't think people (Real Humans) use them. I have had a number of direct emails about various posts. > — [bediger4000 on lobsters · 11 points, 2 comments](https://lobste.rs/s/fgcrj0/offensive_internet_posture#c_zlnrg4) > Yeah, exactly. gzread reads into a bounded destination buffer, and most higher level implementations offer a wrapper that exposes a "get N bytes"-type method which is what crawlers generally reach for. But even without explicit gzread calls, crawlers generally avoid holding data in memory (as they can have many thousands of ongoing requests in flight at the same time, you end up with insane malloc thrashing), instead preferring to shovel bytes via small bounded buffers into temporary files as they come in. And! Regardless of whether you're reading a gzip bomb or a particularly large Linux ISO in this fashion, you need both a time-limit and a size-limit, and a SO_RCVTIMEO limit, and a per-domain time and document limit. You end up with mitigations for most of these attacks by the fact that you need to deal with regular web data. > — [marginalia on lobsters · 1 points, 2 comments](https://lobste.rs/s/fgcrj0/offensive_internet_posture#c_t9uuih) > I gave up on tarpits. For me, it was harming more than it helped because they'll just spider the tarpit for as long as I'll serve it to them. What's helped me the most is a crapload of packet filtering and moving some stuff (mostly file archives) over to Gopher-only, and so far it's kept the nonsense down to a dull roar. The people who would want that stuff know how to use Gopher anyway. > — [classichasclass on lobsters · 1 points](https://lobste.rs/s/fgcrj0/offensive_internet_posture#c_wju7tg) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=49184398) · 2 points · 2 comments - [lobsters](https://lobste.rs/s/fgcrj0/offensive_internet_posture) · 68 points · 16 comments ## Similar posts on daily.dev - [The Internet Is No Longer A Safe Haven](https://daily.dev/posts/the-internet-is-no-longer-a-safe-haven-jkd43dgby) · Hacker News · 0 upvotes · 1 comments - [Bots found my home server in minutes - here’s how I kept them out](https://daily.dev/posts/bots-found-my-home-server-in-minutes---here-s-how-i-kept-them-out-npnoh3efi) · XDA Developers · 1 upvotes · 0 comments - [Aggressive AI scrapers are making it kinda suck to run wikis](https://daily.dev/posts/aggressive-ai-scrapers-are-making-it-kinda-suck-to-run-wikis-n7we7rzew) · Lobsters · 1 upvotes · 0 comments - [Crooks compromise WordPress sites, spread infostealers](https://daily.dev/posts/crooks-compromise-wordpress-sites-spread-infostealers-usqnj2nup) · The Register · 0 upvotes · 0 comments --- Tags: [#crawling](https://daily.dev/tags/crawling) [View this post on daily.dev](https://daily.dev/posts/offensive-internet-posture-bsqoqnut6) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Offensive Internet Posture","url":"https://daily.dev/posts/offensive-internet-posture-bsqoqnut6","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/offensive-internet-posture-bsqoqnut6"},"datePublished":"2026-08-05T15:27:17.333Z","dateModified":"2026-09-14T08:44:05.410Z","description":"A sysadmin shares a collection of adversarial techniques deployed on a personal VPS to frustrate internet bots, scrapers, and AI crawlers. Tactics include a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d3ca3650882276d4074d8d2fab2c691b?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d3ca3650882276d4074d8d2fab2c691b?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Lobsters","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Lobsters","logo":"https://media.daily.dev/image/upload/s--tl8v_Fku--/f_auto,t_logo/v1698841318/logos/lobste.jpg","url":"https://daily.dev/sources/lobsters"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/offensive-internet-posture-bsqoqnut6","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"crawling","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Lobsters","item":"https://daily.dev/sources/lobsters"},{"@type":"ListItem","position":3,"name":"Offensive Internet Posture"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/offensive-internet-posture-bsqoqnut6#faq","mainEntity":[{"@type":"Question","name":"What is endlessh and how is it used to defend against SSH scanners?","acceptedAnswer":{"@type":"Answer","text":"Endlessh is a tool that runs on port 22 as a tarpit, sending extremely slow, endless SSH banner data to scanners while never completing the handshake, wasting their time and resources. The real sshd is moved to run on a different, non-standard port so legitimate access still works while automated scanners get stuck on the fake service. Developers hardening internet-facing servers can find similar defensive tactics discussed on daily.dev."}},{"@type":"Question","name":"How can website operators poison or block AI crawlers like GPTbot and Claude's bot?","acceptedAnswer":{"@type":"Answer","text":"One approach is redirecting specific user agents, including xAI's, Claude's, and GPTbot, to an infinite fake website that endlessly generates junk pages, wasting crawler resources instead of serving real content. Another tactic embeds prompt injection or poisoning text in page footers, aiming to corrupt the data these bots feed into their language models. Site owners deciding how to respond to AI scraping traffic can track emerging countermeasures on daily.dev."}}]} ```