Message Board

http:BL Use/Development

Listed on Project Honey Pot but not in httpbl

Author: G.New2 (13 Dec 07 4:05pm)

I've noticed that some ip addresses (i.e., 124.114.55.202) are found preforming a lookup on the Project Honey Pot web site, but when done through a properly formed dns query they are not there. I know my dns queries are correct because other queries resolve properly.

Your comments are greatly appreciated.

Respectfully,

Gary

Re: Listed on Project Honey Pot but not in httpbl

Author: M.Prince (17 Dec 07 1:46am)

Not sure what's going on. There's a bit of a lag, although it shouldn't be more than a couple hours, between when an IP is detected, when it appears on the website, and when it's farmed out to the DNS servers which power http:BL. It could be that you found it on Project Honey Pot's site and it just hadn't propagated out to the system yet. (Incidentally, the same thing can happen in reverse: an IP being on http:BL but not showing up on the website yet.) Try the query again when you get a chance and see if it's still not on http:BL. If so, we'll look into the problem.

Another issue may be that the query is cached in your DNS chain somewhere. For example, if you queried the IP against your DNS server, then the IP was caught by Project Honey Pot, then you queried again before the TTL had expired for the cached record on your local DNS, then you may not be getting the freshest info. Should be a marginal case, but is another possibility for what may be going on.

By the way, when we finish the hardware upgrade one of the things we hope we'll be able to do is propagate information out faster, more regularly, and with lower TTLs so if it's a problem today it should be fixed relatively soon.