I moved sshd from TCP port 22 to a higher port
2026-08-01T23:31Z.
I also put the
endlessh
tarpit on port 22.
sshd has not seen a single password guessing attempt
since then.
The combination of ssh tarpit, and non-standard port works.
I do these things to make the VPS this blog runs on less palatable for internet bottom feeders.
I found endlessh, an SSH “tarpit” a while back. This is an investigation I did in February of 2020 into its effectiveness.
I came across a 20 year old project called On Bots. I decided to use some of the concepts to create a new Scraper Junkyard.
Internet Sage Chris Siebenmann wrote of a Plague of Googlebot Impersonation on his amazing Wandering Thoughts blog. I decided to find out if I could detect such a plague in this blog’s Apache log files.
My TFTP honey pot has been running for over a month, continuously on my $5 a month VPS, and intermittently on my Dell R530 home server. It’s time to see what surprises it has captured.
One of my blog posts, the one about .git crawlers, got posted to Lobste.rs, a computers and computer science oriented link aggregator, and to Hacker News, a startup, venture capital ideology and occasional science/math link aggregator.
I’ve had another post make it to all three of Hacker News, Slashdot and Lobste.rs before, but on that occasion I compared Hacker News to Slashdot humans. Here, I compare Hacker News to Lobste.rs humans.
I found a small series of odd HTTP requests from IPv4 address 104.244.79.113 while I was looking at Apache web server log files.
Because of the simplicity of TFTP, and the difficulty I had using existing TFTP servers, I decided to write a honey pot TFTP server. This seemed like an easy, no consequences, way to try out my honey pot design principles.
I’ve run various honeypots for a long time. I ran a WordPress honeypot off and on from 2013 to 2018. I’ve run endlessh on my home server for years. Before that, I ran the cowrie ssh/telnet honey pot for a while.
Currently, this website runs a fake WordPress login that tells you that you’ve used the wrong password after a 5 second delay. Feel free to try it. This website’s contact page does nothing but wastes spammers time and effort.
