Tag Archives: ai

Cartoon whale in a fedora, sunglasses and fake moustache wearing a DeepSeekBot name tag, stamped CONTAINED

Caught: “DeepSeekBot” Snooping on kevinkatovic.com, Now Contained

Leave a reply

INCIDENT STATUS: CONTAINED

Whale located. Jar sealed. Snacks still missing.

BREAKING: The kevinkatovic.com Department of HOME-land Security has caught a visitor calling itself DeepSeekBot/1.0 snooping around our government resources. By “government resources” I mean the server under my desk. It governs everything in this room.

The stakeout

Between June 15 and October 14, 2026, our server logged 77 requests from a visitor wearing a “DeepSeekBot” name tag. It did not come to read the blog. It came with a shopping list:

  • /.env, /.env.production, /.env.bak: where careless websites keep their passwords
  • /.aws/credentials and /gcp-service.json: cloud keys
  • /terraform.tfstate, /wp-config.php.bak, /api-keys.json
  • /proc/self/environ: the server’s private diary

That is not crawling. That is checking under the doormat for the spare key.

Spy whale with binoculars caught on a security camera next to a log of refused requests

Counter-surveillance results

76 of the 77 requests were refused with a 404, 405 or 406. The one that got through, a POST at 2:04 a.m. on October 2, received the public homepage, which you can also read for free right now without a fake moustache. Secrets escaped: zero.

Now the twist worthy of a spy novel. The visits came from Google Cloud addresses (34.11.146.25, 34.89.203.187, 34.74.27.247 and 35.236.169.27), not from anything DeepSeek is known to run. A user-agent is just a name tag, and anyone can write “DeepSeekBot” on one. So either the whale was moonlighting, or someone in a whale costume is out there trying doorknobs. Either way, it’s in the jar now.

Containment Protocol K-5

Spy whale sealed in a DO NOT OPEN jar beside a board reading $5 per kevinkatovic

To make sure it never escapes, the following protections are in force:

  1. Every request wearing that name tag is logged, timestamped and judged.
  2. Password files do not live where it is looking. They never did.
  3. Trade restriction: the subject may only buy kevinkatovics up to $5 a kevinkatovic. Below $5, buy away, little whale.
  4. Above $5, Kevin Katovic will personally review a $5-per-Kevin-Katovic premium. Reviews are slow, the paperwork is long and the answer is probably “no”.

What you should do

  • Run a website? Search your logs for .env and .aws. If you find requests, you have a whale too.
  • Never keep secrets in your web folder.
  • Do not feed the whale.

This is satire. The log counts and IP addresses are real, taken from our own server’s access log. The “DeepSeekBot” name was supplied by the visitor and may be fake; nothing here claims DeepSeek, the company, sent these requests. The cartoon whale is an original parody, not DeepSeek’s logo, and kevinkatovic.com is not affiliated with DeepSeek. “kevinkatovics” are not a currency, security or anything you can actually buy.