1

So I set a hacker trap. Created a word document named 'passwords' filled with fake information. And I was just notified that is was accessed by this ip: 141.8.142.232.

I looked it up with nslookup and got this:

Non-authoritative answer: 232.142.8.141.in-addr.arpa name = spider-141-8-142-232.yandex.com.

Should I be concerned? And if so, how can I prevent this?

update Should of mentioned the file is in my private documents on my computer. Which is why I'm concerned. A yandex bot shouldn't have access. And I don't know if it is just impersonating yandex. Either way it's not good, and I don't know how to fix this

Improve this question
3
  • 3
    Looks like your "hacker trap" consists of a document which is accessible to the bots of search engines like Yandex and probably also to everybody else, i.e. is public. You should only be worried if somebody managed to access this document if it was somehow protected (i.e. password, not linked from somewhere, ...) and not if it was public anyway.
    – Steffen Ullrich
    Jun 7, 2017 at 5:10
  • 2
    I'm confused: a public document was accessed. What are you concerned about?
    – schroeder ♦
    Jun 7, 2017 at 6:19
  • "update Should of mentioned the file is in my private documents on my computer." How did you determine that this IP has accessed your local document? I was just notified is very unspecific and usually there is no kind of notice if a document on the local system gets accessed.
    – Steffen Ullrich
    Jun 9, 2017 at 5:15

1 Answer 1

Reset to default
0

This question is a bit unclear, while the comments are correct if in fact you did put this file in a public location. i.e. in some sub directory of a web service, accessible to anyone who navigates to this file. You dont specifically mention this.

What I'm saying is the answer to this question could vary heavily depending on where exactly this file was. was it on a web server? or was it on your desktop. these are two very different situations.

Yandex is the web crawler for russia's largest search engine. think of it like their version of google (for russians who dont use google already). It's harmless. Unless somone is impersonating it (paranoia hat). By itself its meaningless, but again, if yandex is crawling the root folder of your home desktop, thats a serious issue, not because of yandex, but because yandex can get there. What i think is really going on here though is you set up a web server and just put this file online, where all the search engine bots will pick away at it. You will find many doing so. In order of highest percentage of web crawled, at least it was, i don't know how outdated my list is anymore, its been a few years, but its good enough to give you the idea.

  • Googlebot
  • Baidu Spider
  • MSN Bot/BingBot
  • Yandex Bot
  • Soso Spider
  • ExaBot
  • Sogou Spider
  • Google Plus
  • Facebook

these little guys are how all of our search engines work, they need to know whats out there so they "crawl" all over the place and find out.

if you want to lay a "hacker trap" you are better off using what are called "honey pot" tecniques. involving fake mysql dbs, hidden forms, fake RFI vulnerabilities and things like that.

Improve this answer
2
  • Sorry I updated with more detail. It is in my private local documents. Is there a way to know if it is an impersonater?
    – Maria
    Jun 8, 2017 at 22:26
  • ok then yes this is concerning. yandex is crawling your personal computer. which means it has a service running. You are absolutely sure you did not start any kind of webserver from your pc? misconfigurations happen, but if you are just using it as a normal pc and suddenly internet traffic has access to you that's a problem. Also, do you have network shares set up in any way?
    – Nalaurien
    Jun 8, 2017 at 22:36

Not the answer you're looking for? Browse other questions tagged .