[JSegura]

As mentioned in a previous post, our HoneyPots look for exploits with the most common browsers (and plugins).

We generate a pool of URLs refreshed every day, as well as get incoming spam URLs in real time.

An array of machines process those URLs. Every time a malicious URL is found, it gets added to our blacklist.

URLs on the blacklist are verified every hour to make sure the content:

- is the same
- has a different payload
- no longer is there



Jerome Segura