Well didn’t think they would access it, but they did. Someone just looked at my little honey trap ….. from Russia.

Subject: WARNING: access to honeypot

IP = 81.222.223.38
Browser = Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

inetnum: 81.222.223.0 - 81.222.224.255
netname: FRO
descr: JSC “FRO” Network
country: RU
admin-c: DS544-RIPE
tech-c: AG12797-RIPE
status: ASSIGNED PA
notify: ***@eltel.net
mnt-by: ELTEL-RIPE-MNT
changed: ********@eltel.net 20040925
source: RIPE

person: Dmitry Samarin
address: 10N, 65-67,
address: Chaykovskogo st.
address: 191123 Saint-Petersburg
address: Russia
phone: +7 812 4381100
fax-no: +7 812 4381101
e-mail: ***@eltel.net
nic-hdl: DS544-RIPE
changed: ********@eltel.net 20021110
source: RIPE

person: Alexandr Goussev
address: 10N, 65-67,
address: Chaykovskogo st.
address: 191194 Saint-Petersburg
address: Russia

I wonder if it’s an anon proxy? Don’t think so. What hacker would be using IE6? Unless the person is v. sophisticated and changing the user agent.

That IP resolves to www.nwlink.spb.ru — Alliance of Home Networks St-Peterburg. Anyone read Russian?!