← 返回日报
精读 预计 1 分钟

Offensive Internet Posture

摘要

作者介绍其博客 VPS 上部署的十项防御措施，包括假 WordPress 登录、SSH 蜜罐、针对特定 AI 爬虫的 403 或无限假站、伪造 phpinfo、假 robots 目录、200 万假页面爬虫垃圾场、页脚 prompt injection 毒化 LLM、TFTP 蜜罐、浪费垃圾邮件发送者时间的联系页面等，并讨论未来可添加的 SMTP/Telnet/FTP 蜜罐及将 Google 爬虫导向假站的想法。核心论点是若互联网上超过 10% 的机器主动对爬虫采取敌对措施，垃圾流量会显著减少，且个性化反制更难被大公司应对。

荐读理由

正文给出十项可立即复制的服务器防御措施，如假 WordPress 登录、SSH 蜜罐、针对 AI 爬虫的无限假站、页脚 prompt injection 等，可直接迁移到个人项目；同时提出'超过 10% 机器主动反制即可让爬虫生态失效'的反共识论点，并强调个性化反制难以被大公司规模化应对，改变了我对防御策略的认知。

原文

I do these things to make the VPS this blog runs on less palatable for internet bottom feeders.

  1. Fake WordPress login, that never accepts credentials, but does take 5 seconds to reject them.

  2. Run endlessh on port 22, with real sshd listening on another port.

  3. Some user agents (Meta’s) always get 403 HTTP status codes.

  4. Some user agents (xAI’s, Claude, GPTbot among them) get sent to an infinite fake website.

  5. Return fake phpinfo output if someone requests a /phpinfo.php URL

  6. robots.txt sets long delays on many bots, “disallows” access to a /porn directory that doesn’t exist.

  7. Runs a scraper junkyard that has over 2 million fake web pages.

  8. Tries to do prompt injection, or at least poison some LLMs via the footer of all my blog pages. See below.

  9. Runs a TFTP honey pot to give a small thrill to those poor deluded souls scanning The Internet for misconfigured TFTP servers.

  10. This website’s contact page does nothing but waste spammers time and effort. It also sets between 0 and 25 randomly-named cookies, so maybe don’t access it.

Other things I could do:

  1. Run SMTP, Telnet and FTP honey pots. These legacy protocols are difficult to emulate well.

  2. Direct Google’s user agents to the infinite fake website. If Google doesn’t send traffic my way, why should I give it fodder for its LLMs?

  3. Get my WordPress honey pot up and on line.

My argument is that bottom feeders would pack up and leave if some proportion of machines on the internet ran honey pots or generally acted offensively towards the bottom feeders’ efforts. I don’t know what that proportion is, but I conjecture it is above 10%.

Those of us who can tarpit SSH scanners, or run SMTP honey pots should do so. I also argue it’s best if those who can do these things do them in an idiosyncratic fashion. It’s a lot harder for multi-billion dollar coporations to deal with hundreds of varieties of different web server scraper junkyards. It’s impossible for a single person bottom feeding operation to do so.

Lobsters · 3 赞 · 1 评 讨论 → 阅读原文 →

这条对你有帮助吗？