Message Board

Newbie/Basic Questions

Would this be about average?

Author: H.ServerUpper (12 Dec 13 5:18pm)

I have and seldomly visited site that I put up way back about 14 years ago. I pretty much ignored all this time. It does have a guestbook which draws comment spammers. This is basically a very tiny site and I'm wondering how it stacks up as far as trap hits and harvesters caught.

Since putting a honeypot on the site I have been working to get more and more bots interested in it which, is easy to do. I am wondering if my work is paying off?

The honeypot has been up for 15 days. There have been 1,872 spam traps issued and 11 assists with catching harvesters. Would this about average for a small site? I know it's difficult to tell since sites vary in traffic. Just curious.

Re: Would this be about average?

Author: S.Spacres (19 Dec 13 5:33pm)

I'm just another HP user,
But that sounds much better than what i'm seeing off my website for 15+ days.

Re: Would this be about average?

Author: H.ServerUpper (21 Dec 13 7:56am)

Thanks F.Fuz.

The data on my daskboard is stuck on Dec. 12th, which is still at 15 days from the install. It stopped at 4,124 spam traps issued and 17 harvester catch assists. I would expect the number to be tripled by now as I'm drawing more and more bots to the pot.

I have some other sites with HPs that are pretty well protected. I have not had one trap issued from them, because most bots can’t get to the sites. I just wanted to see where I was at with this one site I’m using to draw bots in.

I have effectively blocked bad neighborhoods by what I call climbing the latter. I start with a bad IP and go both directions, up and down, in the neighborhood and block all spiders that hit other HPs. With those sites I can afford to block a lot IP addresses and it pays off.

To get the number of spam traps up on my other site, I create hidden folders and links that a normal visitor can't find. When a bot, or someone manually poking around, finds one I can watch that information spread around world. Interesting to see what countries are connected and how long it takes for that information to spread. Once that folder/link is locked in I create more hidden ones, over and over again. I lost count but I have upwards of a few thousand by now.

Now, I'll bet that any member of Project Honeypot has clicked on IP addresses in the neighborhood of a bad one to see if that IP address is also bad or an IP address from 8 years ago with only 1 visit, something not to be too worried about.

To find that information results in a lot of clicking on IP addresses in the neighborhood and downloading page after page to see the important details of IP addresses. Mainly, the Event, Total, First and Last visit to a HP. On days where the site is slow this can become a very lengthy, if not an impossible process.

This information, Event, Total, First and Last visit to a HP, can be seen all at once if you click on IP Data from the main page. So it can be done. If you could see same layout in the neighborhood view of IP addresses it would be extremely powerful. With one glance you can see all of the active IP addresses in a neighborhood.

Ip addresses in the neighborhood are usually connected to each other, being used by the same group of people. This can substantiated by watching the information spread from finding hidden folders and links, plus just looking at the data on the IP addresses. All that is needed to vastly improve IP inspection is to add those 4 valuable columns in the neighborhood view. The data is there so I wouldn’t think it is impossible to do. This in essence this pulls the cover off of bad neighborhoods for all to see at a single glance. I hope this would considered as an improvement for the site.