Message Board

Tracking Harvesters/Spammers

IP Address Inspector

Author: L.King (4 Jan 10 9:48pm)

I entered my IP into the IP Address Inspector and discovered:

Spider Sightings 3 visit(s)
User-Agents seen with 2 user-agent(s)

The User-Agent strings are:

CSE HTML Validator Pro 10.00 BETA 1G (http://www.htmlvalidator.com/)
CSE HTML Validator Pro 9.03 (http://www.htmlvalidator.com/)

What I think I know:

The IP address is assigned by my VSAT modem (X.X.X.x-1) to my PC, well the router.

I have both versions of CSE HTML Validator installed on my PC and have been using a version for years to edit HTML, and in the last week to add QuickLinks and links to my honey pot.
---------------
Never mind, I just realized what the answer is. After adding the links/QuickLinks I would validate the HTML which includes a check of all links, i.e. follow links (that are not commented) to see if they are a valid. Thous the CSE HTML Validator would visit the honey pot, or act/look like a spider.

Re: IP Address Inspector

Author: M.Prince (6 Jan 10 11:38am)

Yep. Behaves like a spider. Doesn't mean it's a threat. But it does get recorded in case there's future bad activity (e.g., sending to a spamtrap email address that was handed out during one of those visits).

Re: IP Address Inspector

Author: L.King (6 Jan 10 1:43pm)

It does make it an interesting exercise. I can of course avoid the trips to the honey pots by adding the URNs to a do-not-check list in my tools and then hope I don't miss-type or copy them in the future. This of course runs the risk of adding yet another dead link to the internet.

On the other hand it is not clear if just visiting the honey pot again amounts to 'future bad activity.'

"This IP has been whitelisted. Future bad activity will result in automatic removal."

Oh well we will see how this plays out.

Re: IP Address Inspector

Author: M.Prince (10 Jan 10 8:08pm)

Your setup shouldn't create a problem. Just visiting one honey pot (or even multiple honey pots owned by a single user) won't cause a bot to be listed as suspicious. The only way it could get listed is if you sent to an email address that was given to your spider when it visited one of the pages, or if it POSTed to some of the hidden comment forms.

110.138.216.121

Author: L.Sahara (22 May 12 12:10pm)

hay