From 2025-12-31 to 2026-07-31,
34.39.91.209
asked for the URL /posts/economic-intelligence/
27 times a day.
From 2026-08-01 to the present,
34.39.91.209 asked for /posts/economic-intelligence/
three times a day.
How should you decide how well ssh tarpitting
works?
Can you tell if the people who run ssh password guessers
have changed their code to account for the presence
of endlessh
in their target population?
I moved sshd from TCP port 22 to a higher port
2026-08-01T23:31Z.
I also put the
endlessh
tarpit on port 22.
sshd has not seen a single password guessing attempt
since then.
The combination of ssh tarpit, and non-standard port works.
I do these things to make the VPS this blog runs on less palatable for internet bottom feeders.
I found endlessh, an SSH “tarpit” a while back. This is an investigation I did in February of 2020 into its effectiveness.
I came across a 20 year old project called On Bots. I decided to use some of the concepts to create a new Scraper Junkyard.
Internet Sage Chris Siebenmann wrote of a Plague of Googlebot Impersonation on his amazing Wandering Thoughts blog. I decided to find out if I could detect such a plague in this blog’s Apache log files.
My TFTP honey pot has been running for over a month, continuously on my $5 a month VPS, and intermittently on my Dell R530 home server. It’s time to see what surprises it has captured.
One of my blog posts, the one about .git crawlers, got posted to Lobste.rs, a computers and computer science oriented link aggregator, and to Hacker News, a startup, venture capital ideology and occasional science/math link aggregator.
I’ve had another post make it to all three of Hacker News, Slashdot and Lobste.rs before, but on that occasion I compared Hacker News to Slashdot humans. Here, I compare Hacker News to Lobste.rs humans.
I found a small series of odd HTTP requests from IPv4 address 104.244.79.113 while I was looking at Apache web server log files.
