Message Board

http:BL Use/Development

http:BL Data

Author: M.Prince (26 Apr 07 10:59pm)

Our hope with http:BL is that the data it includes is not limited just to Project Honey Pot but comes from many sources. While there are always challenges incorporating different data sets, we would be thrilled to share our data with other projects willing to share with us. Some great potential candidates:

Akismet
The Honeynet Project (honeyd)
Bad Behavior
MT-Blacklist

If you have contacts with these projects, please point them our way. The more data we can exchange with the good guys, the harder it'll be for the bad guys.

Post Edited (5 May 07 2:08am)

Re: http:BL Data

Author: M.Prince (29 Apr 07 4:47pm)

Another great project online it would be wonderful to share data with:

Wikipedia

No one is more attacked by comment spammers, so http:BL could be a resource to help them. At the same time, no one has more data on who the bad guys are so it would be wonderful if they're share some with us so we can share it with the rest of the Internet community.

I've reached out to them, but if anyone has a particular contact, please point them our way.

Re: http:BL Data

Author: S.Enbom (30 Apr 07 3:12pm)

How about collaborating with KnujOn (http://knujon.com/) by sending them spam received by Honeypots? KnujOn has allegedly shut down over 22.000 spamvertised sites since March 2005.

Phishing messages could be sent to Phishtank (http://www.phishtank.com/)

Re: http:BL Data

Author: S.Enbom (30 Apr 07 4:07pm)

Another useful blacklisting service I use is http://denyhosts.sourceforge.net/ which...

" ...thwarts SSH server attacks (also known as dictionary based attacks and brute force attacks). The service now uses..." ...."DenyHosts 2.0 introduces synchronization mode which allows DenyHosts daemons to proactively thwart attackers before they strike your ssh server...."

I*m wondering if SSH dictionary attacks are related to spam dictionary attacks; basically whether a "pwned" ip, that is used to send spam usually also is used also to perform brute force dictionary attacks.

Perhaps a comparison between http://stats.denyhosts.net/stats.html and P.H.P data would be interesting.