SIEGE IN PROGRESS · LIVE

The gates hold.

Every bot that knocks on a door it shouldn't is marked, logged, and reported. These are the attackers at the wall, right now.

THE FALLEN0

TARPIT

Knight = login attack Thief = secret hunter (.env, .git) Forger = email spoofer (forged seal) Brute = one bot that keeps coming back Scout = probing for scripts (.php) Sinks = caught in tarpit Ghost = reported to AbuseIPDB

–Attackers at the wall today

–Reported to AbuseIPDB

–Traps sprung all-time

–Lands sending raiders

–Bot time wasted in the tarpit

Siege map

where the raiders march from

Siege log

updates every 30 seconds

TIME

LAND

ATTACKER

ABUSE SCORE

WEAPON (TRAP HIT)

FATE

What's the abuse score?

Every time this keep reports a raider, AbuseIPDB answers with that IP's abuse confidence score: how sure it is, from 0 to 100%, that the address is malicious. The score comes from reports by thousands of sites and servers over the last 90 days, and reports from many different sources count for more than repeats from one.

0–24% Few or no other reports. A brand-new attacker, or one only just starting.
25–74% Reported by several sources. Probably a bot working through a list of targets.
75–100% Widely reported. Almost certainly a bot hitting sites all over the internet.

A score is a reputation, not proof. Addresses get reassigned and shared, so scores fade as old reports age out. Many firewalls block anything above a chosen score, often around 75%. Click any score in the log to see that IP's full report history on AbuseIPDB.

The Dungeon

One cell for each land. The more bots a country sends, the fuller its cell gets.

PRISONERS: 0

The Treasury

The keys raiders try at the fake gates. Every one of them is wrong.

– keys tried – thieves – different passwords

Most-tried usernames

Most-tried passwords

Favorite combos

Keys only one attacker has tried are partly hidden, in case a real person typed a real password. They show in full once a second attacker tries them.

Honored Guests

Good bots that read the rules and keep to the open roads. They're welcome here, and never reported.

GATE CHECK

–Guest visits

–Different guests

–Read robots.txt first

–Last guest

–Impostors turned away

–Most impersonated

How are guests checked at the gate?

Any bot can say it's Googlebot. Its name is just a line of text it sends with each request, called the user agent, and faking it takes one line of code. So the keep checks their papers:

1A reverse DNS check. The keep asks DNS for the name behind the visitor's address. A real Googlebot address like 66.249.66.1 comes back as crawl-66-249-66-1.googlebot.com. If the name ends in the right company domain, the keep looks that name up again to make sure it points back to the same address. Google and Microsoft both recommend this check.
2Cloudflare's word, when it gives it. Cloudflare, which sits in front of this site, keeps its own list of confirmed good bots. If it marks a visit as one of them, the keep accepts that too. It's a bonus check; the DNS check does the main work.

Faking a user agent is easy. Faking DNS for googlebot.com is not, because only Google controls it. A bot that claims a famous name but fails the check is counted as an impostor, and if it opens a forbidden door, it's reported like any other raider.

Rules of the Keep

The rules are posted. Every forbidden door is listed in robots.txt, the file well-behaved bots read before they visit.
Travelers are counted, never logged. People browsing the keep are welcome. The Tavern counts who's here using only a country and a random ID for each open tab, never an address, and forgets them within two days. Travelers are never reported.
Honored guests are welcome. Search engines and other verified good bots follow the rules, so they're greeted, not reported.
Raiders are reported. No visible link leads to the forbidden doors. A bot that opens one went looking for it and ignored the posted rules, so it's logged and reported to AbuseIPDB right away.
One report at a time. The same raider is reported at most once every 15 minutes. If it comes back sooner, the hit is still logged but marked "Repelled."
Shared with the realm. Each night, the day's raiders are sent to AlienVault OTX, and the last 7 days are in the public blocklist.

Traps on the wall

Doors no real visitor ever opens. Only a bot goes looking for them, so anyone who does is an attacker.

/wp-login.phpFake WordPress login.

/.envFake config file full of fake keys. Bots love it.

/.git/configLooks like an exposed code repo.

/phpmyadmin/Fake database admin panel.

/xmlrpc.phpOld WordPress endpoint, now a tarpit.

/actuator/envFake Java app debug page.

/backup.zipEndless slow download that wastes the bot's time.

/adminGeneric admin doors that don't exist.

/cgi-bin/, /server-statusClassic old-server probes.

robots.txt → /secret-vault/Listed as "forbidden." Bad bots go straight there.

Hidden linkInvisible to people; crawlers follow it.

Fake form fieldA hidden field only bots fill in.

/.aws/credentialsFake cloud keys. Among the most-scanned files online.

/wp-config.php.bakA "forgotten" WordPress backup with fake database login.

/config.jsonFake app secrets, served with a smile.

VPN and firewall loginsFake remote-access portals at the addresses scanners hit most. Every password tried goes to the Treasury.

Any .php fileThis keep runs no PHP at all, so anything asking for a .php file is a bot. Same for .asp, .jsp and .cgi.

Why do bots want these files?

.env, config.json, wp-configSettings files that often hold database passwords and API keys. One leaked file can hand over a whole app.
.gitA code repository left online can reveal the site's entire source code, including any secrets ever committed.
.aws/credentialsKeys to a cloud account. Stolen keys are used to run crypto miners, leaving the owner with a huge bill.
wp-login, xmlrpcWordPress runs over 40% of websites, so guessing its logins is worth it at scale.
phpmyadmin, adminAdmin panels that give full control if the login is weak.
VPN loginsA remote-access login is the front door to a whole company network. Guess one password and an attacker is inside.
any .php fileBots fire off thousands of known file names from old, buggy plugins and web shells, hoping one exists.
backup.zipA forgotten backup is a complete copy of a site, data and all.

The lesson: never put secrets or backups in a website's public folder, block files that start with a dot, and keep admin pages off the open internet.

Run a firewall? Every attacker from the last 7 days is in the public blocklist.txt, one IP per line.