Message Board

Newbie/Basic Questions

Google and Bing listed as malicious

Author: L.ROCHE2 (20 Jul 14 3:01pm)

Hi,

I have a script checking visitors IP on my web site.
I have seen that Google and Bing bots are listed as malicious, for instance, with the following IPs:
- Google: 66.249.74.24
- Bing: 207.46.13.129, 157.55.39.29, 207.46.13.36, 157.55.39.30

The threat level is low, but still I don't understand why they are listed as malicious ? ! ?

Cheers,
L@u

Re: Google and Bing listed as malicious

Author: H.User1325 (20 Jul 14 3:50pm)

They are not listed as malicious. I assume your script is using Http:BL to check visitors.

Suggest you read "Http:BL API Specification"
http://www.projecthoneypot.org/httpbl_api.php

You will see that if the fourth octet is "0" meaning a Search Engine, then this is a special case and the third octet is NOT a treat score. Instead the third octet for a search engine is a serial identifying which known search engine uses the IP address. In the case of 66.249.74.24 the fourth octet is 0 and the third octet is 5 meaning Google.

In the cases of Bing the third octet is 8 meaning MSN. Scrolling to near the end of the documentation, you will find a table identifying several other search engines.

Hope this helps.

Re: Google and Bing listed as malicious

Author: L.ROCHE2 (22 Jul 14 1:40am)

Well, I knew that I missed something.

You are correct I am using Http:BL, and I did not realise that the fourth byte, could also represent a search engine (with value zero). I knew about the other values, I must have missed out the zero value.

Thanks for pointing me in the correct direction, I will amend the script to let through the search engine (with fourth byte equal to zero).

That helped a lot.

Cheers,
L@u