{"id":596,"date":"2007-05-03T15:07:07","date_gmt":"2007-05-03T13:07:07","guid":{"rendered":"http:\/\/planetozh.com\/blog\/honey-pot-httpbl-simple-php-script\/"},"modified":"2007-05-03T15:11:17","modified_gmt":"2007-05-03T13:11:17","slug":"honey-pot-httpbl-simple-php-script","status":"publish","type":"page","link":"https:\/\/planetozh.com\/blog\/my-projects\/honey-pot-httpbl-simple-php-script\/","title":{"rendered":"Honey Pot & http:BL Simple PHP Script"},"content":{"rendered":"

http:BL<\/strong> is a blacklist of all the suspicious IPs that were trapped in one of the honey pots run for Project Honey Pot<\/a>. This service has a simple API, allowing anyone to check an IP against their blacklist. Here is a detailed and simple example script showing how to use this API.<\/p>\n

Honey pot ?<\/h2>\n

Simply put, a honey pot is a webpage that will trick malicious users (as in "robots") into doing something that will allow collecting data about them, while real users (as in "human") won't notice or do anything particular.<\/p>\n

For example, this<\/a> is a honey pot. Open this page in your browser, and you'll see nothing but uninteresting legalish text. Now have a look at the source of the page, and you will spot a hidden <div> containing a form and emails. So, typically, if anything inputs text in that form, or sends anything to those emails, it's not human. It's a program spidering the web in search for spam food.<\/p>\n

Using http:BL<\/h2>\n

First, you'll need to create an account on PHPot<\/a> in order to be given a access key. Don't worry, it's free, and I even suspect it's a spam-free service :P Your access key will be a random string, like ab234fghijkl<\/em><\/p>\n

Testing an IP with http:BL is a simple DNS query. For example, to check IP 12.13.14.15<\/strong> you will need to query the following domain :
\nab234fghijkl<\/span>.15.14.13.12<\/span>.dnsbl.httpbl.org<\/strong>.
\nThe red part is your accesskey, the green part is the IP in the reversed octet format.<\/p>\n

The DNS query response will be something like 127<\/span>.3<\/span>.5<\/span>.1<\/span><\/strong> with the following meaning :<\/p>\n