Message Board

http:BL Use/Development

Is http:BL working?

Author: H.User4239 (4 Oct 11 7:54am)

I'm troubleshooting my http:BL implementation which has worked for years. Recently the IP address 46.109.196.20 got past the http:BL lookup. According to the project honey pot website, it is an active comment spammer with a threat rating of 29. When I query http:BL with the url mykey.20.196.109.46.dnsbl.httpbl.org, the response I get back is my webserver IP address (which I expect when no entry is found) rather than 127.7.29.4 (or something thereabouts). I'm curious, what changed, or what am I missing?

Post Edited (4 Oct 11 11:52am)

Re: Is http:BL working?

Author: G.Baltzell (1 Nov 11 8:01am)

I'm getting this again today for MOST bad IPs. Note I said most but not all. All test IPs work.

Re: Is http:BL working?

Author: G.Baltzell (1 Nov 11 10:38am)

And it seems to be OK again.

Re: Is http:BL working?

Author: G.Baltzell (3 Nov 11 6:30am)

NOT working correctly this morning.

Re: Is http:BL working?

Author: G.Baltzell (3 Nov 11 6:06pm)

Partially back this afternoon. Seems to be OK now.

Re: Is http:BL working?

Author: H.User4239 (7 Nov 11 1:41pm)

Yea - no luck here. IP 89.123.5.146 shows a threat rating of 9 on the website, however the black list returns the server address...

Re: Is http:BL working?

Author: L.Liljegren (10 Nov 11 4:32am)

I'm a newbie. I was coming here to ask what I was doing wrong. Many IP's just return the query I sent. When I send something like this:

mykey.20.196.109.46.dnsbl.httpbl.org and look at the first four entries in the array, I find they are: (mykey,20,196,109 ). If the IP isn't listed in the honey pot, I always get this, but I sometimes get it for IP's that have high threats.

Sometimes I get (127,x,y,z). If I check, when I get the 127, it's always correct.

Re: Is http:BL working?

Author: G.Baltzell (10 Nov 11 3:38pm)

IPs that return the same as the query are supposed to mean they are not listed.

Re: Is http:BL working?

Author: S.Watt2 (23 Nov 11 10:29pm)

And another "it doesn't seem to be working". mykey.179.214.165.188.dnsbl.httpbl.org. returns NXDOMAIN right now (23 Nov 2011 22:27 PST). And there's definitely a listing for 188.165.214.179 at http://www.projecthoneypot.org/ip_188.165.214.179.

Is it time to switch to rsyncing the zone? Is someone else republishing it, by chance?

Oh, and yes, the test addresses work fine. Sigh.

Post Edited (23 Nov 11 10:30pm)

Re: Is http:BL working?

Author: M.Schnell2 (24 Nov 11 3:20am)

Also not working since Nov 24th here...

Re: Is http:BL working?

Author: M.Schlumpf2 (3 Jan 12 4:37am)

Not working again, Spammer get through. >.<

Re: Is http:BL working?

Author: A.Schipper (10 Jan 12 6:55am)

Same issue here as well. IPs that are listed on:
http://www.projecthoneypot.org/list_of_ips.php
are giving me NXDOMAIN responses.

Anyone knows what is going on? Anyone from Project Honey Pot reading this and has an idea?

Re: Is http:BL working?

Author: M.Fourcade (24 Jan 12 9:50am)

Same here :(

Re: Is http:BL working?

Author: T.Walton2 (25 Jan 12 5:57pm)

It looks like it's just on auto-pilot.

Re: Is http:BL working?

Author: M.Fourcade (27 Jan 12 6:39pm)

Still not working :(

Re: Is http:BL working?

Author: P.Lucas2 (29 Jan 12 4:20am)

Not working...

Getting comment spams e.g. from 89.223.43.43 as it's not listed in http:BL even though the Project Honeypot database lists it as a comment spam source...