Show Bankjoy how Workers can confuse attackers by serving fake data instead of blocking them
The principle: Never return a 403 to a detected bot. A 403 tells the attacker "I caught you." A 200 with fake data tells them nothing -- they think they succeeded, but their scraped database is full of garbage. Three tiers: Real data (humans) > Poisoned data (suspicious -- real structure, corrupted values) > Completely fake data (confirmed bots -- all fabricated).
1. API Endpoints (Three Response Tiers)
As a Human (Real Data)
Normal browser request -- passes all checks. Gets real member/account data.
As a Suspected Bot (Poisoned Data)
Missing Accept-Language or old TLS. Gets real structure but corrupted values (wrong emails, randomized balances).
As a Confirmed Bot (Completely Fake)
python-requests UA, cloud VPS ASN, or missing UA. Gets plausible but entirely fabricated data.
Side-by-Side Comparison
Hit the same endpoint three ways to see how the response differs based on detection.
2. Honeypot / Canary Endpoints
These paths should never be accessed by real users. Any client requesting them is a scanner. We serve convincing fake data to waste their time.
3. Tarpit (Slow-Drip Response)
Holds the connection open for ~30 seconds, dripping fake records every 2s. Wastes bot concurrency slots.