Last active
September 10, 2022 09:08
-
-
Save smithweb/7773373 to your computer and use it in GitHub Desktop.
Project Honeypot httpBL PHP class
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<?php | |
define( 'httpBL_KEY', '[YOUR API KEY HERE]' ); | |
class httpBL { | |
private static $_visitor_type = array( | |
0 => 'Search Engine Bot', | |
1 => 'Suspicious', | |
2 => 'Harvester', | |
3 => 'Suspicious, Harvester', | |
4 => 'Comment Spammer', | |
5 => 'Suspicious, Comment Spammer', | |
6 => 'Harvester, Comment Spammer', | |
7 => 'Suspicious, Harvester, Comment Spammer' | |
); | |
private static $_search_engine = array( | |
0 => 'Undocumented', | |
1 => 'AltaVista', | |
2 => 'Ask', | |
3 => 'Baidu', | |
4 => 'Excite', | |
5 => 'Google', | |
6 => 'Looksmart', | |
7 => 'Lycos', | |
8 => 'MSN', | |
9 => 'Yahoo', | |
10 => 'Cuil', | |
11 => 'InfoSeek', | |
12 => 'Miscellaneous' | |
); | |
/** @type string|null Remote IP Address to Query */ | |
protected $_remote_ip = null; | |
/** @type mixed[]|null Response from http:BL query */ | |
protected $_response = null; | |
/** | |
* Construct new httpBL object | |
* | |
* @param string $_remote_ip Remote IP to check | |
* @throws Exception Throws exception if invalid IP address is provided | |
*/ | |
public function httpBL($_remote_ip) | |
{ | |
if (filter_var($_remote_ip, FILTER_VALIDATE_IP)) { | |
$this->remote_ip = $_remote_ip; | |
$this->query(); | |
} else { | |
throw new Exception( "Invalid IP Address" ); | |
} | |
} | |
/** | |
* Performs query of the httpBL service, using a DNS Query. | |
* | |
* See http://www.projecthoneypot.org/httpbl_api.php for | |
* information on proper format and possible responses. | |
* | |
*/ | |
private function query() | |
{ | |
// The http:BL query | |
$this->_response = explode( ".", gethostbyname( HTTPBL_KEY . "." . | |
implode ( ".", array_reverse( explode( ".", | |
$this->remote_ip ) ) ) . | |
".dnsbl.httpbl.org" ) ); | |
} | |
/** | |
* Checks if the ip address was listed in the httpBL | |
* | |
* @return bool True if listed, False if not listed | |
*/ | |
public function isListed() | |
{ | |
if ($this->_response[0] == 127) { | |
return true; | |
} | |
return false; | |
} | |
/** | |
* Returns vistor type as integer | |
* | |
* @return int|bool Vistor type or false if not in httBL | |
*/ | |
public function getVisitorType() | |
{ | |
if ($this->isListed()) { | |
return $this->_response[3]; | |
} | |
return false; | |
} | |
/** | |
* Returns string containing a text description of the visitor type | |
* | |
* @return string|bool Visitor type if listed in httpBL, false if not | |
*/ | |
public function getFormattedVisitorType() | |
{ | |
if ($this->isListed()) { | |
if ($this->_response[3] == 0) { | |
return self::$_visitor_type[$this->_response[3]] . ' (' . self::$_search_engine[$this->_response[2]] . ')'; | |
} else { | |
return self::$_visitor_type[$this->_response[3]]; | |
} | |
} else { | |
return false; | |
} | |
} | |
/** | |
* Gets the threat rating for an ip address if it is listed in the httpBL. | |
* | |
* @return int Threat score (out of a possible 255) | |
*/ | |
public function getThreatRating() | |
{ | |
if ($this->isListed()) { | |
return $this->_response[2]; | |
} | |
return 0; | |
} | |
/** | |
* Gets the number of days since an event was tracked for an ip address | |
* if it is listed in the httpBL. | |
* | |
* @return int Number of days since most recent event (up to max of 255) | |
*/ | |
public function getRecency() | |
{ | |
if ($this->isListed()) { | |
return $this->_response[1]; | |
} | |
return 0; | |
} | |
/** | |
* @return mixed[] Array containing response details | |
*/ | |
protected function getRawResponse() | |
{ | |
return $this->_response; | |
} | |
/** | |
* @return string Remote IP | |
*/ | |
protected function getRemoteIp() | |
{ | |
return $this->_remote_ip; | |
} | |
/** | |
* Checks whether the ip address belongs to a search engine bot or company | |
* | |
* @return boolean True of ip belongs to search engine, false if not | |
*/ | |
public function isSearchEngine() | |
{ | |
if ($this->isListed() && $this->_response[3] == 0) { | |
return true; | |
} | |
return false; | |
} | |
/* | |
* Returns a formatted message with details about the IP address | |
* | |
* @param string $format type of output for the response, text or html | |
* @return string Formatted string of response info | |
*/ | |
public function getFormattedResponse($format = 'text') | |
{ | |
$line_end = "\n"; | |
$output = ''; | |
if ($format == 'html') { | |
$line_end = "<br />\n"; | |
} | |
if ($this->isListed()) { | |
$output .= $this->getFormattedVisitorType() . $line_end; | |
if (!$this->isSearchEngine()) { | |
$output .= "Threat Rating: " . $this->getThreatRating() . " / 255" . $line_end; | |
$output .= "Recency: ". $this->getRecency() . " / 255" . $line_end; | |
} | |
} | |
return $output; | |
} | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment