Someone built a honeypot that catches LLM scrapers in the act
A researcher deployed a fake human verification page that only AI crawlers would fall for. The logs are filling up.
Someone deployed a honeypot specifically designed to catch LLM scrapers. The setup is clever: it looks like a CAPTCHA or human verification page, but the instructions are hidden in a way that only an AI scraping the page structure would see them. The trap instructions tell the bot to visit a specific callback URL and include metadata about itself. Real humans never see these instructions because they are styled to be invisible or buried in HTML comments. An LLM scraper parsing the DOM sees them as plain text and dutifully follows along. The logs show dozens of hits from what appear to be different scraping operations. Some bots identify themselves in the callback data. Others send generic user agents but the timing and behaviour pattern gives them away. A few even return multiple times, suggesting automated pipelines re-scraping the same pages. This is the same principle as email spam traps, but for training data. If you are building a dataset by crawling the web at scale, you will eventually hit pages designed to detect you. The interesting part is not that bots fall for it, but that the honeypot exists at all. It means someone cares enough about their content being scraped to build detection infrastructure. The other implication: if one person can deploy this and get hits within hours, how many of these traps are already out there. Every major model trainer is crawling billions of pages. Some of those pages are honeypots. The question is whether anyone running the scrapers checks the callback logs or just lets the pipeline run blind. I would not be surprised if this becomes standard practice for content platforms that want to track who is scraping them. You cannot stop the bots, but you can at least log which ones showed up and when.
Source: LLM Honeypot