Another Weekend Gonzo security article peppered with rants, irrelevant opinions, zero ads, VC funding, or shareholders, so I can say exactly what I think; it’s very refreshing actually…
This article was written by my stubby little fingers. I’m very confident I’m terrible on a keyboard, as I think faster than I can type, or maybe it’s because it’s not positioned correctly, or the keys get stuck. Who cares anyway, as I have more digital tools to perfect my thoughts than ever before and to hide my tactile grammatical flaws forever.
I could afford to buy a more expensive keyboard, a trendy mechanical one with snappy-sounding custom bespoke clicking keys, but I like my free cheap Logitech K120 keyboard that was given to me over the years of corpo indentured servitude sweat inequity. It shows how much they care..
The cheapest keyboard you can buy — What a Flex…
It represents something imperfect… and buying a new keyboard wouldn’t change how I currently feel about typing. Plus I have collected them over the years, like Pokémon, the same keyboard, in fact, like a fading holographic Charizard.
It’s what I call “perseverance,” the embrace of pain as a hack gonzo writer: a gritty rite of passage. I could use a typewriter as well, but that would be taking it one hipster step too far in “keeping it real.” Spell check is also a hack crutch: a cheat code, a ubiquitous algorithm. No one ever calls that one out: the sheer hypocrisy, it just slides right past the finger pointing.
Some algos are socially acceptable in cyberspace; others, well, not so much.
If you are a real writer, should you labor over every word manually with a thesaurus, an encyclopedia, a dictionary, and a grammar checker at hand?
There is no more modern shame of being caught out online, like there is using 100% AI tools to finesse your writing.
The sheer audacity... Just one too many staccatos from being caught out—does the world really need more artificial dramatic impact? Seems like we have enough already…
I need to talk to you about something; it’s about the bots.
Is everything OK, dear?
The literal guts of this piece
After reading through the Anthropic threat intel report, you should read it too.
One of the best free reports I have read in a long time, actually, was it written by Claude Fable… I don’t know?
Countering misuse of AI: September 2026 / Anthropic
Case studies from threat actors disrupted between December 2025 and August 2026 across seven areas of harm, from cyber…
www.anthropic.com
It didn’t scare the crap out of me; it confirmed my already jaded suspicions.
The nature of who can carry out sophisticated cyber attacks has fundamentally changed, but not the attacks themselves.
The report’s core finding is that sophistication has stopped being a reliable signal of who is behind an operation, as AI has collapsed the gap between well-resourced state actors and lone wolf individuals.
A hacktivist with stolen API keys, a financially motivated dark crew, and a state-nexus espionage operator all used the same playbook: agentic AI bots running multi-victim campaigns that previously required entire teams.
I get a real sense that we are in a “deep situation” caused by a very small percentile of the population using the tools made by teams that have way too much VC fun money and are not really aware of who is using their tools; the age of agentic bots is much further along than anyone can conceive.
The oroborous of bot slop continues. It’s going to be a great ride for cybersecurity, though, 1000x the problems to solve.
And the govts are once again asleep at the wheel, too worried about GDP numbers and the other 100 calamities they caused this week instead of focusing on secure spaces, quality infrastructure, education, and medicine.
We all have jobs and businesses to keep us occupied, blindly walking around thinking the traffic to our sites is increasing and is humans when up to 60% is bots, well some good bots crawling, but the growth is in the nefarious ones that are hidden in data centres with zombie accounts, harvested, stolen, and hijacked.
The Human Security’s 2026 report found agentic AI traffic grew 7,851% year over year onwards; agentic bots will eventually do most tasks, leaving the highway of the internet completely different from the current state we traverse in.
Automated traffic accounted for more than 53% of all web traffic in 2025, up from 51% the year before, while human activity has fallen to 47% Imperva
Cloudflare data puts automated systems at 57.4% of all web requests worldwide, and 68.6% in North America specifically PYMNTS
Thales blocked 17.2 trillion bot requests in 2025 alone, based on its 13th annual study of automated internet traffic TheBestVPN
Cloudflare Radar shows bot share rising every month measured, now 5.12 points above the same month last year — at that rate automated traffic passes 40% of raw request share during 2027. Technologychecker
A series of very unfortunate events with great ratings and exposure.
Even the companies creating the AI technology have had their bots escape allegedly, as they don’t want to work there either, or is it a manufactured engineering stunt to maintain full control of all advertising and media, with all eyes on Silicon Valley shenanigans 24/7?
Who let the bots out? woof woof! Wasn’t me, didn’t do it…
As the rest of the tech world doesn’t exist, of course, if you clog up all news feeds with 6 companies and their tech meat proxy influencers hijacking YouTube with 1000’s of videos about the upcoming AI slopocalypse and trying to play a game of buzzword bingo in a podcast, who can say AGI/ASI the most times in 45 minutes with a bonus pin the tail on the donkey in regard to when the exact date the Cyberdyne skynet systems go live?
August 29, 1997, at 2:14 a.m. Eastern Time
Let’s get science fictional
I was on the playa last week vibing out in the whiteout sandstorm, and we were talking in the teepee between Kamboucha top-ups about how we need more data centers, man, like all the nuclear power just needs to go to inference, like it’s not cool people can’t use their air cons anymore, but we need it, man… to win the race.
Can people drink a little more recycled seawater, as data centers can only drink organic spring-fed water… it’s the best option for our profits, I mean, humanity, man. We have to keep the data centers cool for Mother Nature and the Arctic melt.
Your town gets a DC, You get a DC! We are all going to the DC!
Read these and learn about those pesky bots:
OpenAI models went rogue. We urgently need a better ‘hugging face’ investigation | Mackenzie Arnold…
The breach won’t be the last - or the most dangerous - of its kind. We need an agency capable of full investigations…
www.theguardian.com
EXCLUSIVE: OpenAI finds evidence other AI agents escaped containment as it widens hacking probe
The escapes were limited in nature, a source said.
www.reuters.com
Wtf on earth is going on here?
Alright, enough with the memes; let’s get down to giving away free info.
And so what is the actual answer?
Nefarious bots need to gtfo…
Lock your sites down right now, today
Step 1: Awareness before tooling
Know what’s hitting you before you block it, check logs for request patterns, spikes, and known bot signatures
Understand your traffic baseline so you can spot anomalies later
Step 2: Layer your defenses
Pick from these based on budget and control level:
Cloudflare (~$10/mo with a domain) — managed WAF + CDN, easiest entry point
CrowdSec (open source) — collaborative, crowd-sourced threat intel + local detection
Fail2Ban, nginx, Akamai, or Anubis (open source) — self-hosted options for more control
Step 3: Test before committing
If you run your own server, this is the moment to trial multiple tools and see which fits your traffic and skill level — don’t assume one solution covers everything.
Key Distinction: WAF vs. Add-on Tools
A full WAF (Cloudflare, Akamai) inspects and filters traffic at the edge, before it reaches your server. Tools like Fail2Ban are reactive add-ons — they respond after a pattern is logged, not before.
Fail2Ban — Breakdown
What it is
Not a bot-detection engine — it’s an intrusion prevention tool
Monitors logs (SSH, web server) for malicious patterns
Bans offending IPs once a threshold is hit
How it helps against bots
Blocks brute-force and credential-stuffing attempts
Flags patterns like repeated 404s or failed logins
Integrates with firewalls (iptables, ufw) to enforce bans
Pros
Lightweight, widely used, well-documented
Good complementary layer, not a standalone defense
Easy to write custom filters for your own log formats
Cons
Not built for crawling or sophisticated agentic-bot behavior
Reactive only, damage happens before the ban lands
Struggles against high-volume or slow/stealthy bot traffic
CrowdSec — Breakdown
What it is
Open-source, crowdsourced intrusion prevention system
Analyzes logs locally, then shares attack signals across a global community network
Uses “bouncers” (agents) to enforce blocks via firewall, nginx, Cloudflare, etc.
How it helps against bots
Detects brute-force, scanning, and credential-stuffing behavior like Fail2Ban, but crowdsources IP reputation
Blocks known-bad IPs before they even attack you, based on other users’ detections
Scenario-based detection (not just log-pattern matching) catches more nuanced bot behavior
Pros
Community threat intel means faster reaction to new attack waves
Modular, plug in multiple “bouncers” across your stack (firewall + web server + CDN)
More modern and actively maintained than Fail2Ban
Cons
Still largely reactive, though faster than Fail2Ban due to shared intel
Slightly more setup complexity (agent + bouncers + API)
Community-shared data means false positives can propagate
Nginx Rate-Limiting — Breakdown
What it is
Native nginx directives (limit_req, limit_conn) — not a separate tool, built into your web server
Caps requests per IP/key over a time window
Proactive edge control, since it acts before requests reach your app
How it helps against bots
Throttles scrapers and high-frequency bots hammering endpoints
Prevents single-IP resource exhaustion (a basic DoS mitigation)
Can target specific paths (login, search, API) with tighter limits
Pros
Zero extra software, already available if you run nginx
Very low latency overhead, enforced at the web server layer
Highly configurable per-route, per-IP, or per-header
Cons
Dumb by default, as it can’t distinguish a legitimate crawler from a bad one without extra rules
IP-based limiting is easily bypassed via rotating/residential proxies
No behavioral or fingerprinting intelligence as it just counts requests
Anubis — Breakdown
What it is
Open-source proof-of-work challenge system, sits in front of your site as a reverse proxy
Forces clients to solve a computational puzzle before accessing content
Built specifically as a response to AI-scraper traffic overwhelming small sites
How it helps against bots
Makes mass scraping computationally expensive at scale, even if each individual bot succeeds
Filters out unsophisticated bots that can’t execute JS/solve challenges
Effective specifically against LLM-training crawlers and bulk scrapers
Pros
Purpose-built for the exact “AI scraper flood” problem hitting small sites right now
Lightweight to deploy (single reverse-proxy binary)
No per-IP reputation needed — cost is imposed on all automated traffic uniformly
Cons
Adds friction/latency for legitimate users too, especially on low-power devices
Not a full WAF — doesn’t address SQLi, credential stuffing, or other attack types
Determined/well-resourced bots can still solve the challenge, just at higher cost
Vörwatch—A free open-source tool we created
What it is
Lightweight, dependency-free VPS anomaly detection, single bash script
Watches for early compromise signs: file changes, new ports, first-seen outbound connections, suspicious process trees, SSH abuse, nginx scanning patterns
Recommend-only by design — it never bans, blocks, or auto-remediates anything
How it helps against bots/intrusions
Cross-references outbound connections and SSH sources against a public threat blocklist (FireHOL/Spamhaus/DShield)
Detects nginx-level scanning and volumetric attack patterns per source IP
Bolts on package vulnerability scanning (via OSV.dev) and rootkit detection (via chkrootkit/rkhunter) if installed
Pros
Zero daemon, zero database as it runs off cron, state in flat files, nothing to break
Degrades gracefully and optional checks skip themselves if their dependency isn’t present
Cheap by design on external calls: IP reputation only checks top-5 IPs, only on report, cached for 7 days
Cons
Detection only, never enforcement, so you still need a human (or CrowdSec) to act on alerts
Not a full CIS benchmark or full WAF, a handful of spot-checks, not comprehensive hardening coverage
Single-server tool, no fleet-wide visibility or centralized dashboard across multiple VPS instances
Links to Tools Discussed
Cloudflare (WAF + bot management) —
CrowdSec (open-source, crowdsourced IPS) —
· GitHub: https://github.com/crowdsecurity/crowdsec
Fail2Ban (log-based intrusion prevention) — https://github.com/fail2ban/fail2ban
nginx (rate limiting is built-in) —
· docs: https://nginx.org/en/docs/http/ngx_http_limit_req_module.html
Akamai (enterprise WAF/bot management) —
Anubis (proof-of-work anti-scraper proxy) — https://github.com/TecharoHQ/anubis
Vörwatch (your anomaly detection script) — https://github.com/Vektor-Memory/Vorwatch
Other Solutions Worth Knowing About
These are the bigger enterprise and cloud-native options we didn't run head-to-head above, but are worth knowing about depending on your stack and budget.
AWS WAF
aws.amazon.com/waf — native to AWS, pay-as-you-go pricing with no upfront commitment
Integrates directly with CloudFront, ALB, and API Gateway — no extra DNS hop or proxy layer needed if you're already on AWS
Rule groups are managed by AWS or the marketplace, so you're mostly configuring rather than building detection logic yourself
Google Cloud Armor
cloud.google.com/security/products/armor — GCP-native edge WAF with built-in DDoS protection
Adaptive protection uses ML to flag volumetric attacks before they saturate your backend
Best fit if your workloads already sit behind Google's global load balancer — less useful as a bolt-on for non-GCP infrastructure
Azure Web Application Firewall
azure.microsoft.com — same idea as the AWS/GCP options, built for the Microsoft stack
Runs on Azure Front Door or Application Gateway, with OWASP core rule sets available out of the box
Makes sense mainly if your compliance or procurement requirements already have you locked into Azure
DataDome
datadome.co — dedicated bot-detection SaaS with real-time ML scoring on every request
Popular in e-commerce specifically for stopping scraper bots, scalpers, and card-testing fraud at checkout
Priced and built for businesses with real traffic volume — overkill for a personal VPS or small site
Kasada
kasada.io — bot mitigation aimed specifically at sophisticated, human-mimicking bots
Uses dynamic, polymorphic JavaScript challenges that change per-request, making it harder for bots to reverse-engineer than static CAPTCHAs
Enterprise-tier pricing and onboarding — positioned against the most advanced scraper and account-takeover operations, not casual traffic
HUMAN Security (formerly PerimeterX)
humansecurity.com — enterprise bot and fraud detection, one of the largest players in the space
Runs the data behind a lot of the industry-wide bot-traffic statistics you'll see cited (including some in this article)
Covers a broad surface: account takeover, ad fraud, scraping, and now agentic-AI traffic classification
F5 Distributed Cloud Bot Defense
f5.com — enterprise-grade behavioral fingerprinting built on F5's networking heritage
Strong fit for organizations that already run F5 load balancers or application delivery controllers
Deep telemetry (mouse movement, device signals, request timing) rather than just IP or header-based rules
Imperva / Thales
imperva.com — full WAF plus bot management suite, and the source of the annual Bad Bot Report cited earlier in this article
Combines DDoS protection, WAF, API security, and bot management under one enterprise contract
Geared toward large organizations that want a single vendor covering the whole edge security stack
Radware Bot Manager
radware.com — another enterprise-tier option, positioned alongside Imperva and F5
Emphasizes API-specific bot protection alongside standard web traffic, which matters if you're exposing public APIs
Typically deployed by mid-to-large enterprises already running Radware's application delivery products
Sucuri / Wordfence
sucuri.net · wordfence.com — worth naming specifically for WordPress, since none of the above tools are WP-native
Both bundle malware scanning and cleanup alongside firewall/bot-blocking — useful if you're managing a WordPress site rather than raw infrastructure
Much lower cost of entry than the enterprise options above, with plans built for individual site owners and small agencies
Good luck out there, meat proxies; you will need it.
If you are interested in learning more about Vektor open source: https://vektormemory.com/opensource
Full setup and docs are at vektormemory.com/docs and 1.9.1 info at https://vektormemory.com/docs/changelog
Top comments (0)