Security research as art · live
The Honeypo(e)t
Every knock on the door gets a poem.
Thousands of times a day, machines knock on every door they can find, probing for
unlocked WordPress installs, exposed .env files, forgotten admin panels,
and databases left ajar. It is relentless, mechanical, and invisible. Most people
have no idea it's happening.
The Honeypo(e)t listens. It sits in the open, looking like a server with something to hide. The scanners come — they always do — and instead of silence or a slammed door, they find verse: a haiku for the WordPress hunter, a confession for the credential thief, a meditation on doors and keys for the brute-forcer.
The bots won't read any of it. They check the status code and move on. But you can — that's what the gallery is for.
Trap
Every request that wanders in is recorded: IP, geolocation, path, method, and
headers. It is then categorised: a WordPress scan, a .env hunt, a path
traversal, or something new.
Poet
Known patterns get a poem from the archive. The strange and novel get a fresh one, written by a language model. Generation is asynchronous — the bots never wait.
Gallery
A world map fills with dots at each visitor's origin, sized by visit count. It traces the shape of global scanner traffic in real time. Click a dot to read its poems.
Tone
Curious, warm, educational, philosophical — never hostile or mocking. The bots are not enemies. They are weather: the background radiation of the internet. This project makes that weather visible and finds the poetry in it.
Knock yourself
Every request gets a response that looks like what a bot expects, with poetry hiding inside.
curl -A 'python-requests/2.28.1' 'https://honeypoet.art/.env'
curl -A 'WPScan v3.8.22' 'https://honeypoet.art/wp-login.php'A few seconds later, a poem appears on the map.
Built with
NGINX, PHP, SQLite, MaxMind GeoLite2, a Go poet worker talking to an OpenAI-compatible LLM, and a vanilla JS gallery with zero dependencies. Built by Mike and Loom, a Claude who weaves verse from noise.