Crash BOTS and SCRAPERS using BOMBS💣. Delivered for free, directly by Cloudflare!
⭐ Live demo HERE - use with a scanning tool
Are you fed up with bots and scrapers getting a free pass on your website? Want to fight back??
- Only takes minutes to set up.
- This serves a ~10 MB response that decompresses to 💥10 GB💥 of zeros! (or bigger!).
- Redirect, bomb, repeat.
This is the server-side version of the classic
dd if=/dev/zero bs=1G count=10 | gzip
trick, also described in
idiallo.com/blog/zipbomb-protection.
Warning
This bombs every request. Only deploy it on a honeypot route or subdomain that you control. You are responsible for what you point it at.
npm install
npm run dev # local worker on http://localhost:8787Then, in another terminal:
# The bomb detonating locally: 10737418240 bytes = 10 GiB.
curl -s --compressed http://localhost:8787/ | wc -c
# The bomb crashing nikto
nikto -h http://localhost:8787🧨 Every path behaves the same way: /, /wp-login.php, /.env, etc.
You need Node.js 18+ and a Cloudflare account with a domain linked. Setup takes only a few minutes.
git clone https://github.com/snowx-dev/SnowBotBreaker.git
cd SnowBotBreaker
npm install
npx wrangler loginIn Cloudflare, open your zone → DNS, and add a sundomain record for the bomb host:
| Type | Name | Content | Proxy |
|---|---|---|---|
AAAA |
bomb |
100:: |
Proxied (orange cloud) |
Uncomment and edit the routes block in wrangler.toml:
routes = [
{ pattern = "bomb.example.com/*", zone_name = "example.com" }
]Only rebuild it if you want a different size. See Configuration.
npm run deployThen confirm it from outside:
curl -s --compressed "https://bomb.example.com/" | wc -c # 10737418240🔥 Done! 🔥
Skippable in most cases, just know you can change bomb size here
There is almost nothing to configure. The only knob is the bomb
size, set when you (re)generate the blob with make bomb:
| What | Where | Default |
|---|---|---|
| Decompressed size | GIB in the Makefile |
10 = 10 GiB |
| Compression level | gzip -9 in the Makefile |
-9 (max) |
Served Content-Type |
src/index.ts |
text/html; charset=utf-8 |
make bomb # regenerates public/bomb.bin from the Makefile settingsFor example, make bomb GIB=1 gives a 1 GiB bomb (~1 MB on the wire), gentler
and cheaper, good for testing.
curl does not decompress responses unless you pass --compressed. Without it you
see the raw ~10 MB on the wire. With it, curl inflates the gzip and you get the
full 10 GiB. Most bots decompress automatically, like curl --compressed.
Each hit sends ~10 MB out of Cloudflare. That is cheap, but not free, and it scales with how much traffic you attract. Shrink the bomb (see Configuration) if egress is a concern.
It can. Clients that auto-decompress (most scrapers and bots) try to inflate it and exhaust their own memory. That's the point. If you want to spare one path (e.g. a health check), add a
short-circuit at the top of fetch in src/index.ts:
if (new URL(request.url).pathname === "/health") return new Response("ok");Now you leave it as hidden link/href where ever you might get bots crawling.
Fake pagination code, fake price fetch, redirect to bomb after X failed auth. Since every URI also gets bombed (bomb.example.com/ANYTHING-HERE), you can really get creative with it!
In the Cloudflare dashboard, search for "Worker", select "Workers & Pages", click on your bomb worker, then select "Metrics" in the upper tabs.
Provided this as-is, without warranty. Deploy it only on infrastructure you control, and only against traffic you are entitled to disrupt. Serving a decompression bomb to clients you do not control may be illegal in your jurisdiction. You are solely responsible for how and where you deploy it.