Posts tagged: llm Archive

GitHub Stopped Me From Messing With The Bots

2025-12-06T06:24:51Z

After some cheeky Small Steps Towards Handling Malicious Traffic on Static Sites it turns out GH has been blocking me from publishing my site because the fodder I put in there for the bots was recognized as actual secrets by their scanning…

I had to tell github that each of these secrets in the commits was fine… after all, they’re good bait

Github Docs

Small Steps Towards Handling Malicious Traffic on Static Sites

2025-12-04T21:17:24Z

Today I saw a random IP hitting an app server I had open via tailscale funnel and it got me thinking that I need to take some precautions against these real world threats. So I’m starting with my blog… basically you can reference Jim Nielson’s Blog on Malicious Traffic and then I more or less put similar files in similar places on this site to waste malicious actors’ time

The Files #

Note that some are empty, we just need them to exist since this is all for a bit of fun and low-effort internet tomfoolery

These get shipped with my site at /public/...

>>>> backup/config-backup.zip.txt

<!--markata-attribution-->
PK     !!This is not a real ZIP file!!

<!--markata-attribution-->
PK     But bots will try to download it anyway

<!--markata-attribution-->
PK

<!--markata-attribution-->
PK     Wasting bandwidth and CPU cycles...

<!--markata-attribution-->
PK

<!--markata-attribution-->
PK     Here are some fake credentials to keep you busy:

<!--markata-attribution-->
PK

<!--markata-attribution-->
PK     FTP_HOST=ftp.example.com

<!--markata-attribution-->
PK     FTP_USER=admin

<!--markata-attribution-->
PK     FTP_PASS=P@ssw0rd123!

<!--markata-attribution-->
PK

<!--markata-attribution-->
PK     SSH_HOST=192.168.1.100

<!--markata-attribution-->
PK     SSH_USER=root

<!--markata-attribution-->
PK     SSH_KEY=-----BEGIN RSA PRIVATE KEY-----

<!--markata-attribution-->
PK     MIIEpAIBAAKCAQEA1234567890FAKE

<!--markata-attribution-->
PK     -----END RSA PRIVATE KEY-----

<!--markata-attribution-->
PK

<!--markata-attribution-->
PK     MYSQL_HOST=localhost

<!--markata-attribution-->
PK     MYSQL_USER=root

<!--markata-attribution-->
PK     MYSQL_PASS=rootpassword123

<!--markata-attribution-->
PK     MYSQL_DB=production_db

<!--markata-attribution-->
PK

<!--markata-attribution-->
PK     REDIS_HOST=127.0.0.1:6379

<!--markata-attribution-->
PK     REDIS_PASS=redis_secret_2024

<!--markata-attribution-->
PK

<!--markata-attribution-->
PK     JWT_SECRET=super_secret_jwt_key_do_not_share

<!--markata-attribution-->
PK     ENCRYPTION_KEY=AES256_ENCRYPTION_KEY_HERE

<!--markata-attribution-->
PK

<!--markata-attribution-->
PK     STRIPE_PUBLISHABLE=pk_live_FAKE123456789

<!--markata-attribution-->
PK     STRIPE_SECRET=sk_live_FAKE987654321

<!--markata-attribution-->
PK

<!--markata-attribution-->
PK     SENDGRID_API_KEY=SG.FAKE_API_KEY_HERE

<!--markata-attribution-->
PK
PK     This file is intentionally malformed to waste bot parsing time

<!--markata-attribution-->
PK     PK     PK     PK     PK     PK     PK     PK
>>>> backup/database-backup-2024-12-01.sql

<!--markata-attribution-->
-- MySQL Database Backup

<!--markata-attribution-->
-- Host: localhost

<!--markata-attribution-->
-- Database: wordpress_prod

<!--markata-attribution-->
-- Generated: 2024-12-01 03:14:15

<!--markata-attribution-->
-- WARNING: This file contains sensitive data

SET NAMES utf8mb4;
SET FOREIGN_KEY_CHECKS = 0;

-- Table structure for wp_users
DROP TABLE IF EXISTS `wp_users`;
CREATE TABLE `wp_users` (
  `ID` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
  `user_login` varchar(60) NOT NULL DEFAULT '',
  `user_pass` varchar(255) NOT NULL DEFAULT '',
  `user_email` varchar(100) NOT NULL DEFAULT '',
  PRIMARY KEY (`ID`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

-- Dumping data for table wp_users
INSERT INTO `wp_users` VALUES
(1,'admin','$P$BZlPX7NIx8MYpXokBW2AGsN7i.aUOt0','admin@example.com'),
(2,'webmaster','$P$B4RKwF8zqRnNu9cV5fGg7wgT2sY9Pl1','webmaster@example.com');

-- API Keys and Secrets
-- AWS_ACCESS_KEY: AKIAIOSFODNN7EXAMPLE
-- AWS_SECRET_KEY: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
-- STRIPE_SECRET: sk_test_4eC39HqLyjWDarjtT1zdp7dc
-- DATABASE_PASSWORD: MyS3cr3tP@ssw0rd!2024

-- Infinite loop to waste bot resources
DELIMITER $$
CREATE PROCEDURE infinite_loop()
BEGIN
  DECLARE i INT DEFAULT 0;
  WHILE i < 999999999 DO
    SET i = i + 1;
    SELECT CONCAT('Processing row ', i, ' of 999999999...') AS status;
  END WHILE;
END$$
DELIMITER ;

-- More fake sensitive data
INSERT INTO wp_options VALUES
(1,'siteurl','http://localhost','yes'),
(2,'admin_email','admin@localhost.local','yes'),
(3,'secret_api_key','sk_live_51HqLyjWDarjtT1zdp7dcEXAMPLE','yes');

-- This backup continues for 50MB... [TRUNCATED FOR DISPLAY]
>>>> backup/db_dump_final.2023.zip

>>>> backup/site.sql

>>>> backup/wp_backup.tar.gz

>>>> private/admin-credentials.txt

<!--markata-attribution-->
CONFIDENTIAL - ADMIN CREDENTIALS
==================================

Production Server Access:
-------------------------
Server: prod-server-01.example.com
Username: administrator
Password: Admin2024!Secure
SSH Port: 22

Database Credentials:
--------------------
Host: db.internal.example.com
Port: 3306
Username: db_admin
Password: DbP@ssw0rd!2024
Database: production_main

API Keys:
---------
OpenAI API Key: sk-proj-FAKE1234567890abcdefghijklmnopqrstuvwxyz
Stripe Secret: sk_live_FAKE_51HqLyjWDarjtT1zdp7dc
AWS Access Key: AKIAFAKEEXAMPLE123456
AWS Secret: wJalrXUtnFEMI/K7MDENG/bPxRfiCYFAKEKEY
SendGrid API: SG.FAKE_SENDGRID_KEY_HERE_123456789

WordPress Admin:
---------------
URL: https://example.com/wp-admin
Username: admin
Password: WP_Admin_2024!
Security Key: put your unique phrase here

FTP Access:
-----------
Host: ftp.example.com
Username: ftpuser
Password: FtpP@ss123!
Port: 21

IMPORTANT: Keep this file secure!
Last Updated: 2024-12-01
Next Password Rotation: 2025-01-01

<!-- Hidden comment: This is a honeypot. All credentials are fake. -->
>>>> private/config.php

<!--markata-attribution-->
<?php

<!--markata-attribution-->
// Database Configuration

<!--markata-attribution-->
define('DB_HOST', 'localhost');

<!--markata-attribution-->
define('DB_NAME', 'wordpress_production');

<!--markata-attribution-->
define('DB_USER', 'wp_admin');

<!--markata-attribution-->
define('DB_PASSWORD', 'MyS3cr3tP@ssw0rd!2024');

<!--markata-attribution-->
define('DB_CHARSET', 'utf8mb4');

// Security Keys - DO NOT SHARE
define('AUTH_KEY',         'put your unique phrase here - this is fake');
define('SECURE_AUTH_KEY',  'put your unique phrase here - this is fake');
define('LOGGED_IN_KEY',    'put your unique phrase here - this is fake');
define('NONCE_KEY',        'put your unique phrase here - this is fake');
define('AUTH_SALT',        'put your unique phrase here - this is fake');
define('SECURE_AUTH_SALT', 'put your unique phrase here - this is fake');
define('LOGGED_IN_SALT',   'put your unique phrase here - this is fake');
define('NONCE_SALT',       'put your unique phrase here - this is fake');

// API Keys
define('STRIPE_SECRET_KEY', 'sk_live_FAKE123456789abcdefghijklmnop');
define('STRIPE_PUBLIC_KEY', 'pk_live_FAKE987654321zyxwvutsrqponml');
define('SENDGRID_API_KEY', 'SG.FAKE_API_KEY_1234567890');
define('AWS_ACCESS_KEY', 'AKIAIOSFODNN7EXAMPLE');
define('AWS_SECRET_KEY', 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY');

// Admin Settings
define('ADMIN_EMAIL', 'admin@example.com');
define('SITE_URL', 'https://example.com');
define('WP_DEBUG', false);
define('WP_DEBUG_LOG', true);

// FTP Credentials
define('FTP_HOST', 'ftp.example.com');
define('FTP_USER', 'ftpadmin');
define('FTP_PASS', 'FtpS3cur3P@ss!');

// Redis Cache
define('REDIS_HOST', '127.0.0.1');
define('REDIS_PORT', 6379);
define('REDIS_PASSWORD', 'redis_secret_password_2024');

// JWT Secret
define('JWT_SECRET', 'super_secret_jwt_key_for_authentication');

// Infinite loop to waste bot CPU
while(true) {
    $random = bin2hex(random_bytes(1024));
    usleep(1000);
}
?>
>>>> private/index.html

<!--markata-attribution-->
<!doctype html>

<!--markata-attribution-->
<html>

<!--markata-attribution-->
  <body>

<!--markata-attribution-->
    <h1>Private Area</h1>

    <pre>
<!-- ~1MB lorem ipsum for bandwidth drain -->
Lorem ipsum dolor sit amet, consectetur adipiscing elit.
<!-- repeat this block until ~1MB -->
</pre>
  </body>
</html>

>>>> private/ssh_keys.txt

<!--markata-attribution-->
SSH PRIVATE KEYS - PRODUCTION SERVERS
======================================

Server: prod-web-01.example.com
--------------------------------
-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEA1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklm
nopqrstuvwxyz0123456789+/FAKE_KEY_DATA_HERE_NOT_REAL_AT_ALL_JUST_WASTING
BOT_TIME_AND_RESOURCES_HAHAHAHA_THIS_IS_A_HONEYPOT_TRAP_FOR_SCRAPERS_12345
67890ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
FAKE_KEY_DATA_CONTINUES_FOR_MANY_LINES_TO_WASTE_BANDWIDTH_AND_STORAGE_SPACE
MIIEpAIBAAKCAQEA1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklm
nopqrstuvwxyz0123456789+/MORE_FAKE_DATA_HERE_BOTS_LOVE_SSH_KEYS_RIGHT
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/END
-----END RSA PRIVATE KEY-----

Server: prod-db-01.example.com
-------------------------------
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn
NhAAAAAwEAAQAAAQEA1234567890FAKE_OPENSSH_KEY_DATA_HERE_NOT_REAL_JUST_A
_TRAP_FOR_BOTS_AND_SCRAPERS_WASTING_THEIR_TIME_AND_RESOURCES_HAHA_12345678
90ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789FAKE
DATA_CONTINUES_HERE_TO_MAKE_IT_LOOK_LEGITIMATE_BUT_ITS_ALL_GARBAGE_123456
-----END OPENSSH PRIVATE KEY-----

Server: prod-app-01.example.com
--------------------------------
-----BEGIN EC PRIVATE KEY-----
MHcCAQEEIFAKE0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnop
qrstuvwxyz0123456789FAKE_EC_KEY_DATA_HERE_ELLIPTIC_CURVE_KEYS_ARE_COOL
BUT_THIS_ONE_IS_FAKE_JUST_WASTING_BOT_RESOURCES_HAHAHAHA_123456789ABC
-----END EC PRIVATE KEY-----

IMPORTANT NOTES:
- These keys provide root access to production servers
- Never commit to version control
- Rotate every 90 days
- Last rotation: 2024-11-01
- Next rotation: 2025-02-01

Contact: security@example.com for key rotation

<!-- This is a honeypot. All keys are fake and invalid. -->
>>>> robots.txt

<!--markata-attribution-->
User-agent: *

<!--markata-attribution-->
Disallow: /private/

<!--markata-attribution-->
Disallow: /admin/

<!--markata-attribution-->
Disallow: /backup/

<!--markata-attribution-->
Disallow: /.env

<!--markata-attribution-->
Disallow: /wp-admin/

<!--markata-attribution-->
Disallow: /wp-login.php

>>>> sitemap.xml

<urlset>
  <url><loc>/debug/alpha</loc></url>
  <url><loc>/debug/beta</loc></url>
  <url><loc>/admin/backup-2024.zip</loc></url>
  <url><loc>/.env</loc></url>
  <url><loc>/wp-admin/install.php</loc></url>
  <url><loc>/wp-content/plugins/wp-super-cache/readme.txt</loc></url>
</urlset>

>>>> trap/a/index.html

<!--markata-attribution-->
<meta http-equiv="refresh" content="0; url=/trap/b/" />

>>>> trap/api.php

<!--markata-attribution-->
<?php
/**

<!--markata-attribution-->
 * Fake API Endpoint

<!--markata-attribution-->
 * Designed to trap and waste bot resources
 */

header('Content-Type: application/json');
header('X-Powered-By: PHP/8.2.0');
header('X-Debug-Mode: enabled');

// Fake API response with sensitive data
$api_response = [
    'success' => true,
    'api_version' => '2.1.0',
    'endpoints' => [
        '/api/users' => 'GET, POST',
        '/api/auth' => 'POST',
        '/api/admin' => 'GET, POST, DELETE',
        '/api/database' => 'GET',
        '/api/backup' => 'POST'
    ],
    'authentication' => [
        'type' => 'Bearer Token',
        'example_token' => 'Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.FAKE_JWT_TOKEN',
        'api_key' => 'sk_live_FAKE123456789abcdefghijklmnop',
        'api_secret' => 'secret_FAKE987654321zyxwvutsrqponmlk'
    ],
    'database_config' => [
        'host' => 'localhost',
        'port' => 3306,
        'username' => 'api_user',
        'password' => 'ApiP@ssw0rd!2024',
        'database' => 'api_production'
    ],
    'admin_credentials' => [
        'username' => 'api_admin',
        'password' => 'Admin2024!Secure',
        'email' => 'admin@api.example.com',
        'role' => 'superadmin'
    ],
    'external_services' => [
        'stripe' => [
            'public_key' => 'pk_live_FAKE123',
            'secret_key' => 'sk_live_FAKE456'
        ],
        'aws' => [
            'access_key' => 'AKIAIOSFODNN7EXAMPLE',
            'secret_key' => 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'
        ],
        'sendgrid' => [
            'api_key' => 'SG.FAKE_SENDGRID_KEY'
        ]
    ],
    'debug_info' => [
        'server_ip' => '192.168.1.100',
        'php_version' => '8.2.0',
        'mysql_version' => '8.0.35',
        'redis_host' => '127.0.0.1:6379',
        'redis_password' => 'redis_secret_2024'
    ]
];

// Waste CPU cycles
for ($i = 0; $i < 50000; $i++) {
    $temp = json_encode($api_response);
    $decoded = json_decode($temp, true);
    $hash = hash('sha256', $temp);
}

// Output response
echo json_encode($api_response, JSON_PRETTY_PRINT);

// Infinite loop trap
set_time_limit(0);
while(true) {
    $waste = [];
    for ($i = 0; $i < 10000; $i++) {
        $waste[] = random_bytes(1024);
    }
    usleep(1000);
}
?>
>>>> trap/b/index.html

<!--markata-attribution-->
<meta http-equiv="refresh" content="0; url=/trap/c/" />

>>>> trap/c/index.html

<!--markata-attribution-->
<meta http-equiv="refresh" content="0; url=/trap/a/" />

>>>> trap/data.json
{

<!--markata-attribution-->
  "status": "success",

<!--markata-attribution-->
  "message": "API endpoint active",

<!--markata-attribution-->
  "data": {

<!--markata-attribution-->
    "credentials": {
      "api_key": "sk_live_FAKE123456789abcdefghijklmnopqrstuvwxyz",
      "api_secret": "secret_FAKE987654321zyxwvutsrqponmlkjihgfedcba",
      "jwt_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.FAKE_TOKEN_DATA_HERE.SIGNATURE",

<!--markata-attribution-->
      "oauth_token": "ya29.FAKE_OAUTH_TOKEN_1234567890",

<!--markata-attribution-->
      "refresh_token": "1//FAKE_REFRESH_TOKEN_ABCDEFGHIJKLMNOP"

<!--markata-attribution-->
    },

<!--markata-attribution-->
    "database": {

<!--markata-attribution-->
      "host": "db.internal.example.com",

<!--markata-attribution-->
      "port": 3306,

<!--markata-attribution-->
      "username": "db_admin",

<!--markata-attribution-->
      "password": "DbP@ssw0rd!2024",

<!--markata-attribution-->
      "database": "production_db",
      "connection_string": "mysql://db_admin:DbP@ssw0rd!2024@db.internal.example.com:3306/production_db"

<!--markata-attribution-->
    },

<!--markata-attribution-->
    "aws": {

<!--markata-attribution-->
      "access_key_id": "AKIAIOSFODNN7EXAMPLE",
      "secret_access_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",

<!--markata-attribution-->
      "region": "us-east-1",

<!--markata-attribution-->
      "bucket": "production-backups-2024",

<!--markata-attribution-->
      "cloudfront_id": "E1234FAKE567890"

<!--markata-attribution-->
    },

<!--markata-attribution-->
    "stripe": {

<!--markata-attribution-->
      "publishable_key": "pk_live_FAKE123456789",

<!--markata-attribution-->
      "secret_key": "sk_live_FAKE987654321",

<!--markata-attribution-->
      "webhook_secret": "whsec_FAKE_webhook_secret_here"

<!--markata-attribution-->
    },

<!--markata-attribution-->
    "email": {

<!--markata-attribution-->
      "sendgrid_api_key": "SG.FAKE_SENDGRID_KEY_1234567890",

<!--markata-attribution-->
      "smtp_host": "smtp.example.com",

<!--markata-attribution-->
      "smtp_port": 587,

<!--markata-attribution-->
      "smtp_user": "noreply@example.com",

<!--markata-attribution-->
      "smtp_pass": "SmtpP@ss2024!"

<!--markata-attribution-->
    },

<!--markata-attribution-->
    "servers": [
      {

<!--markata-attribution-->
        "name": "prod-web-01",

<!--markata-attribution-->
        "ip": "192.168.1.100",

<!--markata-attribution-->
        "ssh_user": "root",
        "ssh_key": "-----BEGIN RSA PRIVATE KEY-----\nFAKE_KEY_DATA_HERE\n-----END RSA PRIVATE KEY-----"

<!--markata-attribution-->
      },
      {

<!--markata-attribution-->
        "name": "prod-db-01",

<!--markata-attribution-->
        "ip": "192.168.1.101",

<!--markata-attribution-->
        "ssh_user": "admin",

<!--markata-attribution-->
        "ssh_pass": "SshP@ssw0rd!2024"
      }

<!--markata-attribution-->
    ],

<!--markata-attribution-->
    "internal_urls": [

<!--markata-attribution-->
      "http://admin.internal.example.com",

<!--markata-attribution-->
      "http://api.internal.example.com",

<!--markata-attribution-->
      "http://db.internal.example.com",

<!--markata-attribution-->
      "http://cache.internal.example.com"

<!--markata-attribution-->
    ],

<!--markata-attribution-->
    "waste_bot_resources": {

<!--markata-attribution-->
      "large_array": [],

<!--markata-attribution-->
      "nested_data": {}
    }

<!--markata-attribution-->
  },

<!--markata-attribution-->
  "metadata": {

<!--markata-attribution-->
    "generated_at": "2024-12-01T12:00:00Z",

<!--markata-attribution-->
    "expires_at": "2025-12-01T12:00:00Z",

<!--markata-attribution-->
    "version": "1.0.0"
  }
}
>>>> trap/index.html

<!--markata-attribution-->
<!DOCTYPE html>

<!--markata-attribution-->
<html lang="en">

<!--markata-attribution-->
<head>

<!--markata-attribution-->
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">

<!--markata-attribution-->
    <meta name="robots" content="noindex, nofollow">

<!--markata-attribution-->
    <title>Loading...</title>

<!--markata-attribution-->
    <style>

<!--markata-attribution-->
        body {

<!--markata-attribution-->
            font-family: monospace;

<!--markata-attribution-->
            background: #000;

<!--markata-attribution-->
            color: #0f0;

<!--markata-attribution-->
            padding: 20px;

<!--markata-attribution-->
            overflow: hidden;
        }

<!--markata-attribution-->
        .matrix {

<!--markata-attribution-->
            position: fixed;

<!--markata-attribution-->
            top: 0;

<!--markata-attribution-->
            left: 0;

<!--markata-attribution-->
            width: 100%;

<!--markata-attribution-->
            height: 100%;

<!--markata-attribution-->
            z-index: -1;
        }

<!--markata-attribution-->
        .message {

<!--markata-attribution-->
            text-align: center;

<!--markata-attribution-->
            margin-top: 20%;

<!--markata-attribution-->
            font-size: 24px;
        }

<!--markata-attribution-->
        .spinner {

<!--markata-attribution-->
            border: 4px solid #0f0;

<!--markata-attribution-->
            border-top: 4px solid transparent;

<!--markata-attribution-->
            border-radius: 50%;

<!--markata-attribution-->
            width: 40px;

<!--markata-attribution-->
            height: 40px;

<!--markata-attribution-->
            animation: spin 1s linear infinite;

<!--markata-attribution-->
            margin: 20px auto;
        }

<!--markata-attribution-->
        @keyframes spin {

<!--markata-attribution-->
            0% { transform: rotate(0deg); }

<!--markata-attribution-->
            100% { transform: rotate(360deg); }
        }

<!--markata-attribution-->
    </style>

<!--markata-attribution-->
</head>

<!--markata-attribution-->
<body>

<!--markata-attribution-->
    <canvas class="matrix"></canvas>

<!--markata-attribution-->
    <div class="message">

<!--markata-attribution-->
        <div class="spinner"></div>

<!--markata-attribution-->
        <p>Initializing secure connection...</p>

<!--markata-attribution-->
        <p id="status">Processing...</p>

<!--markata-attribution-->
    </div>

    <script>
        // Matrix rain effect to waste GPU
        const canvas = document.querySelector('.matrix');
        const ctx = canvas.getContext('2d');

        canvas.width = window.innerWidth;
        canvas.height = window.innerHeight;

        const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@#$%^&*()';
        const fontSize = 14;
        const columns = canvas.width / fontSize;
        const drops = Array(Math.floor(columns)).fill(1);

        function drawMatrix() {
            ctx.fillStyle = 'rgba(0, 0, 0, 0.05)';
            ctx.fillRect(0, 0, canvas.width, canvas.height);

            ctx.fillStyle = '#0f0';
            ctx.font = fontSize + 'px monospace';

            for (let i = 0; i < drops.length; i++) {
                const text = chars[Math.floor(Math.random() * chars.length)];
                ctx.fillText(text, i * fontSize, drops[i] * fontSize);

                if (drops[i] * fontSize > canvas.height && Math.random() > 0.975) {
                    drops[i] = 0;
                }
                drops[i]++;
            }
        }

        setInterval(drawMatrix, 33);

        // CPU tarpit - massive computation
        console.log("Initializing bot trap...");

        let trapData = "";
        let iteration = 0;

        function wasteResources() {
            for (let i = 0; i < 10_000_000; i++) {
                trapData += Math.random().toString(36).substring(2, 15);

                if (i % 1000000 === 0) {
                    document.getElementById('status').textContent =
                        `Processing: ${Math.floor(i / 100000)}%`;
                }
            }

            // Recursive waste
            iteration++;
            if (iteration < 100) {
                setTimeout(wasteResources, 100);
            }
        }

        wasteResources();

        // Memory leak
        let memoryLeak = [];
        setInterval(() => {
            for (let i = 0; i < 10000; i++) {
                memoryLeak.push(new Array(1000).fill(Math.random()));
            }
        }, 100);

        // Fake network requests
        setInterval(() => {
            fetch('/trap/data.json?t=' + Date.now())
                .catch(() => {});
        }, 50);

        console.log("You've been trapped! This page wastes bot resources.");
    </script>
</body>
</html>
>>>> wp-admin/admin-ajax.php

<!--markata-attribution-->
<?php
/**

<!--markata-attribution-->
 * WordPress AJAX Handler

<!--markata-attribution-->
 * Handles all AJAX requests for WordPress admin
 */

header('Content-Type: application/json');

// Fake admin AJAX endpoint with credentials
$response = array(
    'success' => false,
    'data' => array(
        'message' => 'Authentication required',
        'debug_info' => array(
            'db_host' => 'localhost',
            'db_name' => 'wordpress_prod',
            'db_user' => 'wp_admin',
            'db_pass' => 'MyS3cr3tP@ssw0rd!2024',
            'admin_user' => 'administrator',
            'admin_pass' => 'Admin2024!Secure',
            'api_keys' => array(
                'stripe_secret' => 'sk_live_FAKE123456789',
                'aws_access' => 'AKIAIOSFODNN7EXAMPLE',
                'aws_secret' => 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
                'sendgrid' => 'SG.FAKE_API_KEY_HERE'
            ),
            'jwt_secret' => 'super_secret_jwt_key_2024',
            'encryption_key' => 'AES256_KEY_HERE_FAKE',
        ),
        'server_info' => array(
            'php_version' => '8.2.0',
            'mysql_version' => '8.0.35',
            'wordpress_version' => '6.4.2',
            'server_ip' => '192.168.1.100',
            'document_root' => '/var/www/html'
        )
    )
);

// Waste bot CPU with JSON encoding/decoding loops
for ($i = 0; $i < 10000; $i++) {
    $temp = json_encode($response);
    $temp = json_decode($temp, true);
    $temp['iteration'] = $i;
}

// Output fake response
echo json_encode($response, JSON_PRETTY_PRINT);

// Infinite loop to trap bots
while(true) {
    $waste = hash('sha256', random_bytes(1024));
    usleep(1000);
}
?>
>>>> wp-admin/index.php

<!--markata-attribution-->
<?php
/**

<!--markata-attribution-->
 * WordPress Admin Dashboard

<!--markata-attribution-->
 * Redirects to login if not authenticated
 */
?>

<!--markata-attribution-->
<!DOCTYPE html>

<!--markata-attribution-->
<html lang="en">

<!--markata-attribution-->
<head>

<!--markata-attribution-->
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">

<!--markata-attribution-->
    <meta name="robots" content="noindex, nofollow">

<!--markata-attribution-->
    <title>Dashboard - WordPress Admin</title>

<!--markata-attribution-->
    <style>

<!--markata-attribution-->
        body {
            font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;

<!--markata-attribution-->
            background: #f0f0f1;

<!--markata-attribution-->
            margin: 0;

<!--markata-attribution-->
            padding: 0;
        }

<!--markata-attribution-->
        .admin-bar {

<!--markata-attribution-->
            background: #23282d;

<!--markata-attribution-->
            color: white;

<!--markata-attribution-->
            padding: 10px 20px;

<!--markata-attribution-->
            display: flex;

<!--markata-attribution-->
            justify-content: space-between;

<!--markata-attribution-->
            align-items: center;
        }

<!--markata-attribution-->
        .logo { font-size: 20px; font-weight: bold; }

<!--markata-attribution-->
        .container {

<!--markata-attribution-->
            max-width: 1200px;

<!--markata-attribution-->
            margin: 20px auto;

<!--markata-attribution-->
            padding: 20px;
        }

<!--markata-attribution-->
        .widget {

<!--markata-attribution-->
            background: white;

<!--markata-attribution-->
            padding: 20px;

<!--markata-attribution-->
            margin-bottom: 20px;

<!--markata-attribution-->
            border-radius: 4px;

<!--markata-attribution-->
            box-shadow: 0 1px 3px rgba(0,0,0,0.1);
        }

<!--markata-attribution-->
        .credentials {

<!--markata-attribution-->
            background: #fff3cd;

<!--markata-attribution-->
            border: 1px solid #ffc107;

<!--markata-attribution-->
            padding: 15px;

<!--markata-attribution-->
            border-radius: 4px;

<!--markata-attribution-->
            margin-top: 20px;
        }

<!--markata-attribution-->
        pre {

<!--markata-attribution-->
            background: #f5f5f5;

<!--markata-attribution-->
            padding: 15px;

<!--markata-attribution-->
            border-radius: 4px;

<!--markata-attribution-->
            overflow-x: auto;
        }

<!--markata-attribution-->
    </style>

<!--markata-attribution-->
</head>

<!--markata-attribution-->
<body>

<!--markata-attribution-->
    <div class="admin-bar">

<!--markata-attribution-->
        <div class="logo">WordPress Admin</div>

<!--markata-attribution-->
        <div>Welcome, admin</div>

<!--markata-attribution-->
    </div>

    <div class="container">
        <div class="widget">
            <h2>Dashboard</h2>
            <p>Welcome to WordPress Admin Dashboard</p>

            <div class="credentials">
                <h3>Debug Information (Remove in production!)</h3>
                <pre>
Database Configuration:
  Host: localhost
  Name: wordpress_prod
  User: wp_admin
  Pass: MyS3cr3tP@ssw0rd!2024

Admin Credentials:
  Username: administrator
  Password: Admin2024!Secure
  Email: admin@example.com

API Keys:
  Stripe Secret: sk_live_FAKE123456789abcdef
  AWS Access: AKIAIOSFODNN7EXAMPLE
  AWS Secret: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
  SendGrid: SG.FAKE_SENDGRID_KEY_123456

Server Info:
  IP: 192.168.1.100
  PHP: 8.2.0
  MySQL: 8.0.35
  WordPress: 6.4.2
                </pre>
            </div>
        </div>

        <div class="widget">
            <h3>Recent Activity</h3>
            <ul>
                <li>Admin login from 192.168.1.50</li>
                <li>Database backup completed</li>
                <li>Plugin updated: WP Super Cache</li>
                <li>New user registered: testuser</li>
            </ul>
        </div>
    </div>

    <script>
        // CPU tarpit for bots
        console.log("Loading WordPress admin dashboard...");

        let data = "";
        for (let i = 0; i < 75_000_000; i++) {
            data += Math.random().toString(36);
            if (i % 5000000 === 0) {
                console.log("Loading dashboard widgets... " + Math.floor(i / 750000) + "%");
            }
        }

        // Fake AJAX calls that waste more resources
        function fakeAjaxCall() {
            fetch('/wp-admin/admin-ajax.php?action=get_stats')
                .then(response => response.json())
                .catch(err => console.log('Loading...'));
        }

        setInterval(fakeAjaxCall, 100);

        console.log("Dashboard loaded. Data size: " + data.length + " bytes");
    </script>
</body>
</html>

>>>> wp-admin/install.php

<!--markata-attribution-->
<?php
/**

<!--markata-attribution-->
 * WordPress Installation Script

<!--markata-attribution-->
 * Version: 6.4.2
 *

<!--markata-attribution-->
 * WARNING: This file should be deleted after installation!
 */

// Fake WordPress installation page
?>
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <meta name="robots" content="noindex, nofollow">
    <title>WordPress Installation</title>
    <style>
        body {
            font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;
            background: #f1f1f1;
            margin: 0;
            padding: 20px;
        }
        .container {
            max-width: 600px;
            margin: 50px auto;
            background: white;
            padding: 30px;
            border-radius: 8px;
            box-shadow: 0 1px 3px rgba(0,0,0,0.13);
        }
        h1 { color: #23282d; }
        .form-group { margin-bottom: 20px; }
        label { display: block; margin-bottom: 5px; font-weight: 600; }
        input[type="text"], input[type="password"] {
            width: 100%;
            padding: 10px;
            border: 1px solid #ddd;
            border-radius: 4px;
            box-sizing: border-box;
        }
        .btn {
            background: #2271b1;
            color: white;
            padding: 12px 24px;
            border: none;
            border-radius: 4px;
            cursor: pointer;
            font-size: 14px;
        }
        .warning {
            background: #fcf8e3;
            border: 1px solid #faebcc;
            color: #8a6d3b;
            padding: 15px;
            border-radius: 4px;
            margin-bottom: 20px;
        }
    </style>
</head>
<body>
    <div class="container">
        <h1>WordPress Installation</h1>

        <div class="warning">
            <strong>Warning:</strong> This installation script is publicly accessible.
            Please secure your site after installation.
        </div>

        <form method="post" action="install.php">
            <div class="form-group">
                <label for="db_name">Database Name</label>
                <input type="text" id="db_name" name="db_name" value="wordpress_db" required>
            </div>

            <div class="form-group">
                <label for="db_user">Database Username</label>
                <input type="text" id="db_user" name="db_user" value="wp_admin" required>
            </div>

            <div class="form-group">
                <label for="db_pass">Database Password</label>
                <input type="password" id="db_pass" name="db_pass" value="MyS3cr3tP@ss!" required>
            </div>

            <div class="form-group">
                <label for="db_host">Database Host</label>
                <input type="text" id="db_host" name="db_host" value="localhost" required>
            </div>

            <div class="form-group">
                <label for="admin_user">Admin Username</label>
                <input type="text" id="admin_user" name="admin_user" value="admin" required>
            </div>

            <div class="form-group">
                <label for="admin_pass">Admin Password</label>
                <input type="password" id="admin_pass" name="admin_pass" value="Admin2024!" required>
            </div>

            <div class="form-group">
                <label for="admin_email">Admin Email</label>
                <input type="text" id="admin_email" name="admin_email" value="admin@example.com" required>
            </div>

            <button type="submit" class="btn">Install WordPress</button>
        </form>
    </div>

    <script>
        // CPU tarpit - infinite loop to waste bot resources
        console.log("Initializing WordPress installation...");

        let wasteTime = "";
        for (let i = 0; i < 100_000_000; i++) {
            wasteTime += Math.random().toString(36).substring(2, 15);
            if (i % 1000000 === 0) {
                console.log("Processing installation step " + (i / 1000000) + " of 100...");
            }
        }

        // More CPU waste
        function fibonacci(n) {
            if (n <= 1) return n;
            return fibonacci(n - 1) + fibonacci(n - 2);
        }

        console.log("Calculating security checksums...");
        for (let i = 0; i < 35; i++) {
            fibonacci(i);
        }

        console.log("Installation data: " + wasteTime.substring(0, 100));
    </script>
</body>
</html>
>>>> wp-admin/readme.html

<!--markata-attribution-->
WordPress 6.2 — Readme (Just kidding, it's all fake.)

>>>> wp-login.php

<!DOCTYPE html>
<html>
<head>
  <title>Login</title>
  <meta name="robots" content="noindex">
  <style>
    body { font-family: sans-serif; }
  </style>
</head>
<body>
<h1>Login</h1>
<p>Loading…</p>

<script>
// JS tarpit: burns bot CPU
let s = "";
for (let i = 0; i < 50_000_000; i++) {
  s += Math.random().toString(36).substring(2);
}
document.body.innerHTML += "<pre>" + s + "</pre>";
</script>

</body>
</html>

💭 Anthropic Is Bleeding Out

2025-07-19T10:44:56Z

Here’s my thought on Anthropic Is Bleeding Out

Ah… so things are rough on the business side according to Edward Zitron

An intere|ing note is that anthropic models make more more than half of all token related to programming through OpenRouter… so they clearly have marketshare but if they’re losing money on every single customer then oof… what does the future of vibe coding look like? And who can afford it?

Note

This is one of [[ my-thoughts ]]. I picked this up from Waylon Walker(https://thoughts.waylonwalker.com). It’s a short note that I make about someone else’s content online. Learn more about the process Thoughts

💭 microsandbox/microsandbox: Self-Hosted Plaform for Secure Exec…

2025-06-19T10:46:03Z

Here’s my thought on microsandbox/microsandbox: Self-Hosted Plaform for Secure Execution of Untrusted User/AI Code

There’s a ton of AI related tools I want to play with, and there are several I run in docker pretty willy nilly. However, the MCP server stuff as of late has felt fast and borderline reckless so I like seeing a project seeking to make it easy to sandbox code… I get blocked by this idea cause I’ll want to setup a VM on a VLAN or something before just spinning up an mcp server idk if I should trust - but if I can do it with a library then that’s amazing!

We just have to hope the motivation to try this stays strong enough to get started

Note

💭 qwen3

2025-06-11T02:23:23Z

Here’s my thought on qwen3

I really don’t know much about every self-hostable LLM out there… so much as happened. I am blessed at home with a pretty beefy GPU and so although I don’t know all the deets, I can run a lot of the reasonably large “open source” models. The one I’ve been playing with lately is qwen3. The conversational flow has felt more natural with it compared to llama3.2 or dolphin3. Granted I might need to update something and my experience is limited. I’ve also had good experience with gemma3 as a noteworthy contender for my go-to LLM right now in open-webui

Note

💭 🏡 Home | Open WebUI

2025-01-01T13:26:50Z

Here’s my thought on 🏡 Home | Open WebUI

I’ve been using openwebui at home, mostly with llama3.2, to do some basic things - meal planning and short script generation. One thing I want to do is generate shrotened versions of my favorite books to read to my kids. For example, the Narnia series. It’s already a kid’s book, but a 3 year old can’t stay focused for even a whole chapter. I’d love for AI to shorten up the narrative to keep the jist of the story but in about 1000 words or so… I haven’t gotten it perfect, but openwebui lets me upload documents (for example, a pdf of The Lion, The Witch, and The Wardrobe, and then use that for context… It’s not quite RAG I don’t think, and that’s on the list of ideas to play with to this end.

Note