Bot Honeypot
This page contains several hidden links and routes that only a bot would find.
Blocklists
Ready-to-use IP blocklists, one deduped IPv4 address per line. Feed them straight to your firewall or fail2ban.
- Strict blocklist — every IP that tripped any trap or probed for vulnerabilities (any category).
- Permissive blocklist — IPs that tripped the honeypot traps (secret, forbidden, javascript) plus vulnerability probers that hit 5+ unique paths.
Note: For these to be effective you should probably host your own instance of this on whatever infrastructure you're trying to protect. There's no reason to believe the bot hitting me also hit you.
Naughty Robots
These visitors ignored robots.txt and found our hidden link. Naughty naughty!
Robots.txt Scanners
These bots found the route that only exists in robots.txt. They're actively scanning forbidden content!
Silly Scrapers
These bots found the link hidden in JavaScript comments. They must be using regex to scrape links instead of semantically parsing HTML!
Vulnerability Probers
These bots were looking for common vulnerabilities and misconfigured servers. Nice try!