June 15, 2026
Spam bait and switch
Honeypot Design
This guy built fake traps for internet creeps and the comments are loving the chaos
TLDR: The writer says more people should run fake online traps that waste scammers’ time, arguing it could discourage low-level abuse across the web. In the comments, readers split between playful nitpicking and nostalgic old-school stories, turning a niche security post into a surprisingly fun little drama.
A longtime internet tinkerer just dropped a manifesto for wasting bad actors’ time on purpose, and the vibe in the community is basically: petty, but make it security. His site already runs a fake WordPress login that stalls for five seconds before saying the password is wrong, plus a contact page that appears to work but really just sends spammers into the void. His bigger argument? More people should set up these digital decoys so scammers, scrapers, and other online pests burn their own time and resources instead of everyone else’s. It’s half neighborhood watch, half revenge fantasy, and readers absolutely clocked the vigilante energy.
The comments are small but deliciously telling. One reader instantly turned the author’s numbered list of six design rules into a tiny roast, joking, “I think there might be 7 and maybe 8 too,” which has the energy of someone side-eyeing a “final” draft that is very much not final. Another commenter came in with full old-internet war stories, reminiscing about building an early honeynet in the late 1990s when machines sat on public internet addresses with basically no safety rails. That memory lane detour gives the whole post an extra layer of grizzled hacker grandpa credibility: this isn’t just theory, it’s part of a much older cat-and-mouse game online.
The strongest reaction here isn’t outrage, it’s delight. People seem charmed by the idea of turning annoyance into art — making spam bots and shady scanners wander through fake doors while real humans watch the logs like it’s reality TV for cyber creeps.
Key Points
- •The article draws on the author’s experience running several honeypots, including a WordPress honeypot, endlessh, and cowrie.
- •It describes active decoy elements on the current site, including a fake WordPress login and a contact page intended to consume spammer effort.
- •The article presents six honeypot design considerations covering resource efficiency, attacker resource consumption, realism, logging, collateral damage, and attractiveness to attackers.
- •It states that honeypot design involves trade-offs, such as tension between mimicking real services and maximizing attacker cost.
- •The article says honeypot operation is iterative and resembles an arms race, requiring ongoing updates informed by observed attacker behavior.