IP Address Inspector
The Project Honey Pot system has detected behavior from the IP address consistent with that of a spam harvester. Below we've reported some other data associated with this IP. This interrelated data helps map spammers' networks and aids in law enforcement efforts. If you know something about this IP, please leave a comment.
|Harvester First Seen||approximately 5 years, 3 months, 2 weeks ago|
|Harvester Last Seen||within 4 years, 3 months, 3 weeks|
|Harvester Sightings||1,959 visit(s) to 257 honey pot(s)|
108.262 messages per visit
212,085 message(s) resulting from harvests
- First: approximately 5 years, 3 months, 1 week ago
- Last: approximately 1 week ago
1,242 email address(es) harvested
- First: approximately 5 years, 3 months, 2 weeks ago
- Last: Tue, 03 Mar 2009 00:13:54 -0800
|Time From Harvest
To First Spam
Fastest: 1 day, 11 hours, 14 mins, 56 secs
Slowest: 4 weeks, 7 hours, 46 mins, 44 secs
Average: 1 week, 21 hours, 49 mins, 23 secs
Std Dev: 4 days, 14 hours, 5 mins
In my logs, I see a lot of Java Spider activity coming from this IP. It seems to look for any non-image file that it can download and then downloads it. It could be for harvesting emails, but I also think it is looking for executable scripts for exploitation of weaknesses.
I think it would be interesting and relatively simple to set traps for this spider say in index.html you could have it say there's a file at index1.html and then creates the file, then index1.html does the same thing, keeping the spider occupied for a few thousand bogus links, then quits.
January 02 2009 08:59 AM