I am looking for a database of IP Addresses of known bots, so I can identify them in web site traffic.
I have useragent data, but there seem to be plenty that don't give useragents to identify themselves. These tend to be the spambots.
I know about project honeypot, but I don't know if that has a database I can easily access.
Not that I know of.
As most spam-bots and the like are probably running on compromised home machine any such list would be quickly out of date, as some hosts are cleaned and the bot gets introduced to other hosts by some means, and wouldn't be overly useful anyway - just about all you could do is block web traffic from the hosts on the list or add a message to the web server's scripted responses to inform the user that they may be infected.
Give a message to the user is a waste of time IMO - many will ignore it, many that should see it won't as you will not haver their correct address in the database (due to them not having a fixed address, accessing through a proxy that has more than one outward facing address, or their legitimate traffic going through a proxy that the bot traffic bypasses, and those that you do manage to correctly inform of the issue will probably expect you to know how to fix it for them...
Probably your best bet is: xbl.spamhaus.org. From the site:
The Spamhaus Exploits Block List (XBL) is a realtime database of IP addresses of hijacked PCs infected by illegal 3rd party exploits, including open proxies (HTTP, socks, AnalogX, wingate, etc), worms/viruses with built-in spam engines, and other types of trojan-horse exploits
No doubt many of the sources of spam are from exploited servers, so this comes down to your definition of a "bot". Many spammers rent servers and send only spam from it - they won't be doing much legitimate web browsing from them. You could really use any Spam RBL and probably get a good idea of how much web traffic is coming from compromised services.
