Message Board

http:BL Use/Development

Submit hits back to ProjectHoneyPot

Author: J.Le Grice (24 Oct 07 5:34am)

OK I have just implemented a PHP script to catch some comment spammers that are hitting a clients contactus page.

At this stage all I do is throw up a bugger off page and send myself a notification email of the attempt.

What I would really like to also do is notify ProjectHoneyPot in some way that an attempt has been made to use my form to disemminate SPAM by a listed IP address. This will keep the IP address fresh in the lists.

Take this IP: 211.172.225.137 According to the IP lookup we get

Spider First Seen approximately 4 weeks ago
Spider Last Seen within 1 week
Spider Sightings 147 visit(s)

First Received From approximately 3 weeks ago
Last Received From within 3 weeks
Number Received 3 email(s) sent from this IP

First Post On approximately 4 weeks ago
Last Post On within 1 week
Form Posts 36 web post submission(s) sent from this IP

But he has just hit my form (24/10/2007 21:24:23 NZDT) so the stats should be updated to reflect this. Maybe the DNS query could update this in some way given that we have to provide a http:BL key to query the DNS Server.

Keep up the good work guys and thanks for providing a means of protecting my clients Contact Us forms.

Re: Submit hits back to ProjectHoneyPot

Author: M.Prince (24 Oct 07 7:59pm)

One thing a lot of people do when they have a comment spammer hit one of their other traps is redirect them to a PHPot honey pot. If you can do that it'll often help provide data back to the community about the spammer your system trapped.

Interesting idea re: http:BL updating the IP Inspector pages. Problem, for us, is that the logs from the DNS servers are scattered around the Internet and may be a challenge for us to parse. I'll have some of or engineers look into it and see if they can get something up. At the very least, would be cool to report: "This IP has been stopped by http:BL X times."

Thanks for the suggestions!