Hacker News Reader

I'm doing the same thing. Set up a honeypot API and having it log everything anything tries to access outside that home page. Collected 15,000 hits in a week from 300 unique IPs doing the usual WordPress and .env scans.

I'm just collecting the data now to be used to secure some of my upcoming projects, but I would absolutely also like to take it in a direction where it sends the bots into an infinite slow loop, or preferably something that burns as many tokens as possible for them.

I don't really care about the morality of that. I'm a big fan of fighting fire with fire.

> something real slow that takes up all their time

Not to throw water on your plan, but the bots I've written intentionally run very slow with respect to each target. When done in parallel, across a wide range of targets, it doesn't slow down the effort at all.

Serve them a zip bomb? LLM poison text?