Message Board

http:BL Use/Development

http:BL returning not found for spammer IPs

Author: C.Lovejoy (29 Jun 12 7:40am)

Hello,

We've had great results using http:BL over the past few weeks. Since we implemented a combined http:BL/ReCaptcha policy on our contact forms we've not had a single spam message get through.

Last night, however we had several come through. The source IPs are listed as known spammers in the IP database but http:BL queries for those IPs return a not found response. I've also tested using some addresses from the directory of malicious IPs and received the same response for some and a correct response for others.

One of the spammer IPs that got through on our site:
http://www.projecthoneypot.org/ip_93.182.181.9

% host <key>.9.181.182.93.dnsbl.httpbl.org
Host <key>.9.181.182.93.dnsbl.httpbl.org not found: 3(NXDOMAIN)

One listed on the Malicious IP page:
http://www.projecthoneypot.org/ip_110.85.102.112
% host <key>.112.102.85.110.dnsbl.httpbl.org
Host <key>.112.102.85.110.dnsbl.httpbl.org not found: 3(NXDOMAIN)

And another from the Malicious IP page (which works):
http://www.projecthoneypot.org/ip_173.44.37.234
% host dmjktbxwlcma.234.37.44.173.dnsbl.httpbl.org
dmjktbxwlcma.234.37.44.173.dnsbl.httpbl.org has address 127.1.75.5

After testing a good number of the listed IPs it appears that none of the IP addresses listed with a first contact date of 2012-06-28 are appearing in the http:BL list. Is there a delay in updating the list for http:BL that could be causing this?

Thanks,
chap

Re: http:BL returning not found for spammer IPs

Author: H.User1325 (9 Jul 12 10:40pm)

Now that I have the http:BL API working, and finely got a comment spammer to leave a comment on the updated webpage, I have basically the same question.

94.27.74.223 left a comment and http:BL returned NXDOMAIN

When I use the IP Lookup seems that the response should have been: 127.7.15.4 i.e. last seen 1 week ago, threat level 15, comment spammer. URL's in the comment I received are the same domain as listed in the IP Lookup, and similar keywords.

Re: http:BL returning not found for spammer IPs

Author: S.Metler2 (15 Nov 12 5:42pm)

Hi there,

Same here ...

I am seeing a lot (not just one or two) obvious spammers that are not found in the http:BL DNS query, but those same IPs return results on the ProjectHoneyPot website (so they are in fact represented in the ProjectHoneyPot data.)

// working
193.151.59.37.dnsbl.httpbl.org has address 127.1.30.5

// spammer - not in http:BL
202.186.41.193.dnsbl.httpbl.org not found: 3(NXDOMAIN)

// project honey pot website results with Threat Rating = 16
http://www.projecthoneypot.org/ip_193.41.186.202

Any advice would be appreciated!