I'm doing the same thing. Set up a honeypot API and having it log everything anything tries to access outside that home page. Collected 15,000 hits in a week fr

I'm doing the same thing. Set up a honeypot API and having it log everything anything tries to access outside that home page. Collected 15,000 hits in a week from 300 unique IPs doing the usual WordPress and .env scans. I'm just collecting the data now to be used to secure some of my upcoming projects, but I would absolutely also like to take it in a direction where it sends the bots into an infinite slow loop, or preferably something that burns as many tokens as possible for them. I don't really care about the morality of that. I'm a big fan of fighting fire with fire.