Message Board

Newbie/Basic Questions

DNS responce vs Web

Author: J.Lim11 (8 Nov 14 6:59pm)

I am using Http:BL and confused about API score reporting.
When I check 173.242.124.212 with API it returns score: 48 (127.37.48.5). The same Threat Rating: 48 I see for that IP when checking projecthoneypot.org website.
For 208.52.168.58 Threat Rating: 20 on website but API returns the same string requested (I guess it does that when threat is 0).
I checked numerous IPs and if on website Threat Rating is under 40sh then API just bounces request.

Why is that?

IPs checked:
196.20.65.211
83.172.0.119
109.88.13.122
113.140.93.10

Thanks

Re: DNS responce vs Web

Author: H.User1325 (9 Nov 14 6:55am)

Yes this sometimes happens. See

http://www.projecthoneypot.org/board/read.php?f=10&i=418&t=418

By the way when http:BL returns your request string it does not mean the threat is 0. From the documentation it means:

"A majority of IP addresses do not appear in http:BL's records. If a IP you query for does not appear, http:BL will return a non-result {NXDOMAIN}.

A non result does not mean an IP address is certified in any way to be non-malicious. Instead, a non-result simply indicates that no malicious behavior has been observed by the IP in the recent past. You should continue to exercise caution when letting any visitor onto your website, even if the visitor is not listed in http:BL's records."

Re: DNS responce vs Web

Author: J.Lim11 (9 Nov 14 8:11am)

> Yes this sometimes happens.

I would be nice if it happens sometimes but it happens too often.