Five Days of Project Honey Pot Announcements

Project Honey Pot Allows You to Monitor Your IP Space

Spam sometimes happens even to good IP addresses. We try to make it clear throughout the Project Honey Pot site that just because an IP address appears here does not mean its owner is a spammer. Addresses are hijacked, hosting companies are duped, or an exploit of some kind can turn your own machine into a zombie. Today we are announcing a new service to make it a bit easier to see if your IP space is being used for malicious purposes.

Project Honey Pot's Monitor service allows you to continuously watch the IP space you control for any malicious behavior. The basic service allows you to setup a range of up to 256 IPs, a /24 CIDR, or an AS Number along with 5 individual IPs not included in any of those ranges. We will then create a Monitor page on our website which will inform you of IP addresses in your monitored range that are observed engaged in some form of malicious behavior: spamming, harvesting, comment spamming, or otherwise acting naughty.

The basic service is free to any active member of Project Honey Pot. Visit the Monitor configuration page in order to setup your Monitor account.

Monitor Mini-FAQ

Why are you limiting the range I can monitor?

Allowing an unlimited monitoring range would mean people could monitor the entire Internet. This could compromise the effectiveness of the Project Honey Pot data by giving away more information that we'd like. We set the ranges allowed in order to cover the needs of most of our members. If you need to monitor a wider range, contact us to talk about enhanced services.

Do I need to check my Monitor page daily?

Different IP address spaces are more or less prone to attack. We encourage you to check your Monitor page regularly. You can also setup email alerts to notify you when any attacks are noticed. Finally, before long we plan to include support for an RSS feed from your Monitor page so you can include the data in your own in-house abuse desk applications.

How often is the data updated?

The data is updated at least daily. Please note, however, that there may be a lag between a bad event happening and our being able to definitively report it. For example, a harvester in your IP space may be trawling the web picking up email addresses, but a spammer may not send to those email addresses for several weeks, months, or even years. We cannot definitively identify the harvester until the first email message is sent. You are therefore encouraged to run historical reports on your IP space on a regular basis.

I'm looking through my logs to try and identify the activity you reported, what time zone are your time stamps?

All timestamps on the Project Honey Pot site are based on the timezone for the Eastern United States. The offset from GMT is noted in the timestamps on the Monitor page.

This is the last day of the Five Days of Project Honey Pot. Thanks for bearing with us. The Five Days thing was clearly a bit of a gimmick, but we are glad for those of you who followed along. In the last five days we've gained several thousand new members and hundreds of new honey pots. That benefits everyone in the Project.

We promise we won't be sending any more daily emails for the foreseeable future. We will post major updates to the lawsuit on the Project Honey Pot site. And we hope you will continue to check back with the Project Honey Pot and encourage your friends to join too.