Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

Re:Someone is running mass vulnerability scans, spoofing AI ... by somat on Wednesday August 12, 2026 @06:49PM (#49279656)

Yeah, It started bothering me enough that I recently put together a system where when a application detects a bad actor(a bot enumerating too fast, a random scan for vulnerabilities, etc) it notifies the firewall. Right now I am just shutting them down, But have plans for a honeypot/tarpit system, something real slow that takes up all their time. Something like "have fun at 300 baud"

[ Parent | on HN ]

Re:Someone is running mass vulnerability scans, spoofing AI ... by ThePinion on Wednesday August 12, 2026 @07:07PM (#49279807)

I'm doing the same thing. Set up a honeypot API and having it log everything anything tries to access outside that home page. Collected 15,000 hits in a week from 300 unique IPs doing the usual WordPress and .env scans.

I'm just collecting the data now to be used to secure some of my upcoming projects, but I would absolutely also like to take it in a direction where it sends the bots into an infinite slow loop, or preferably something that burns as many tokens as possible for them.

I don't really care about the morality of that. I'm a big fan of fighting fire with fire.

[ Parent | on HN ]

Re:Someone is running mass vulnerability scans, spoofing AI ... by infinite_spin on Wednesday August 12, 2026 @07:15PM (#49279854)

> something real slow that takes up all their time

Not to throw water on your plan, but the bots I've written intentionally run very slow with respect to each target. When done in parallel, across a wide range of targets, it doesn't slow down the effort at all.

[ Parent | on HN ]

Re:Someone is running mass vulnerability scans, spoofing AI ... by imglorp on Wednesday August 12, 2026 @08:27PM (#49280357)

Serve them a zip bomb? LLM poison text?

[ Parent | on HN ]