Two Second Memory

20 July, 2007

Project Honey Pot

Well after being hounded by Mr Palmer (well he suggested that I join a couple of times) to join Project Honey Pot I finally joined and donated some MX records and put it on this website. I want to put it on Limes & Lycopene but there is no script for Ruby as of yet.

There are a number of good introductions to Project Honey Pot: here & here but it essentially boils down to laying traps for spammers (or more specifically harvesters) and then tracking them when they send spam. This information is then made available via their http:BL service which allows you to do a DNS lookup on an ip address to determine if it is a known spammer.

Given that I’ve just finished the new blog and Kathryn is still getting some spam even though she is using akismet (albeit a very small amount) I thought that I use http:BL there. Unfortunately there was no ruby code written that I could find (this is an unusual thing in it’s own right) so I’ve knocked up a small class that interfaces to the http:BL.

The code in it’s entirety is:

require 'resolv'
    require 'ipaddr'

class HttpBl

TYPE = { "0" => [:search_engine],
                 "1" => [:suspicious],
                 "2" => [:harvester],
                 "3" => [:suspicious, :harvester],
                 "4" => [:comment_spammer],
                 "5" => [:suspicious, :comment_spammer],
                 "6" => [:harvester, :comment_spammer],
                 "7" => [:suspicious, :harvester, :comment_spammer] }

# Create a new HttpBL with the key as required to access this service.
        # See http://www.projecthoneypot.org/httpbl_configure.php to get a key.
        def initialize(key)
            @key = key
        end

# Perform a lookup on the provided ip address.
        def check(ip_addr)
            ip = IPAddr.new(ip_addr)
            query = "#{@key}.#{ip.reverse.gsub("in-addr.arpa", "dnsbl.httpbl.org")}"

begin
                lookup = Resolv.getaddress(query)
                values = lookup.split(".")
                { :last_activity => values[1], :threat => values[2], :type => TYPE[values[3]], :raw_data => lookup }
            rescue Resolv::ResolvError => error
                return {}
            end
        end
    end

And that’s it. You can download a tarball here containing the above code and some tests.

Any comments welcome.

Filed by rgh at 17:27 under General

2 Responses to “Project Honey Pot”

Patrick

September 28th, 2007 | 10:31

http://www.oreillynet.com/ruby/blog/2007/09/7_reasons_i_switched_back_to_p_1.html

have a read……
rgh

September 29th, 2007 | 12:14

And your point is what exactly?

You must be logged in to post a comment.

20 July, 2007

Project Honey Pot

2 Responses to “Project Honey Pot”

Leave a reply

Links

Archives

Categories

Pages