IP Address Inspector
The Project Honey Pot system has detected behavior from the IP address consistent with that of a comment spammer. Below we've reported some other data associated with this IP. This interrelated data helps map spammers' networks and aids in law enforcement efforts. If you know something about this IP, please leave a comment.
|Geographic Location||United States|
|Spider First Seen||approximately 8 years, 7 months, 2 weeks ago|
|Spider Last Seen||within 7 years, 2 months, 4 weeks|
|Spider Sightings||11,026 visit(s)|
|User-Agents||seen with 30 user-agent(s)|
|First Post On||approximately 8 years, 5 months, 3 weeks ago|
|Last Post On||within 7 years, 2 months, 4 weeks|
|Form Posts||25,169 web post submission(s) sent from this IP|
April 30 2014 05:43 AM
Spotted on www.simonkarman.nl
Ingevulde contact formulier www.simonkarman.nl ===================================================
E-mail adres: email@example.com
Eighty rabbits competed in this manner: We know the deal you come up to 60% off standard room rates online gambling to get in., casino online, [url="http://svenskacasinoonlinesource.eu/"]casino online[/url], nlit, online casino sverige, [url="http://kluhartem.com/"]online casino sverige[/url], 8-DD,
Verstuurd op 06/03/2014 16:29:26 via het IP adres 126.96.36.199
March 07 2014 04:26 AM
2014-03-01 20:39:38 POST /GBoek.aspx
A potentially dangerous Request.Form value was detected from the client (ctl00$ucZoeken1$txtZoeken="...respect., < a href="http://sven...").
Failed to post because of my anti-spam.code.
March 01 2014 04:10 PM
It uses what looks like a message ID or hash in the comment itself - probably because if the page is indexed, it can just google the ID or scrape the page itself and look for the ID rather than the whole message.
This is very common technique.
ID is: VhlUdD
February 22 2014 05:46 AM
Spotted by script as "EvilBot".
Tried POST, ended up in honeypot.
Honeypot denied acces in robots.txt, requested it anyway with GET - both with and without cookies set.
Fingerprint: Useragent is IE6, no GZIP accepted, no acceptlanguage, close was preferred, all of which is very common for these script kiddie spam bots. Protocol HTTP 1.1 - this one differs between the bots.
GET -> POST time: 1 second. It furthermore waits 3-4 seconds then tries GET with and without cookies set to see if the post went through.
Rank: Script kiddie spam bot.
February 22 2014 05:36 AM
2 spam entries on contact form within a minute:
Message from 188.8.131.52 rejected, 2014-02-17 19:40
[cName] => Ehuvsvnx
[email] => firstname.lastname@example.org
[phone] => KDeaGAvFhTLftNP
[subject] => GDgajmheRMUDGn
[recipient] => 1
[message] => It depends on binary options review world location., cialis,
[url="http://getcialissoft.com/"]cialis[/url], :]], cialis online,
[url="http://cialisedtreatment.com/"]cialis online[/url], :-[,
February 18 2014 07:34 AM
tracks back to a chinese website, attempted to comment on a page that is static html without comments
February 16 2013 09:56 PM
Bruteforce attack on non-existent forum
February 16 2013 11:10 AM