Honeypot For Identifying Email-Harvesters

I say... by JoeLinux · 2003-06-21 09:51 · Score: 5, Interesting

That there should be email addresses that the big companies "float" out onto spamming lists. When a mass email comes back with these email addresses, it's a flag that its spam, and block the whole message from going into the system. Of course, security on what those email addresses are would have to be pretty tight...

Re:I say... by Eyston · 2003-06-21 10:03 · Score: 3, Interesting

This is exactly what a lot of them do.

I think Earthlinks Spam Blocker is using that idea.

-Eyston
Re:I say... by Eyston · 2003-06-21 10:06 · Score: 1

btw, I mean the first one, not this challenge-response peice of junk.

-Eyston
Re: I say... by gidds · 2003-06-21 10:44 · Score: 3, Insightful

BrightMail, too.Â My ISP uses it - it traps about 70% of my spam.Â The great thing is that it has no false positives, so it just shunts every spam it identifies off to a separate mailbox which you need never bother with - you don't spend time or bandwith downloading it.Â (A few times a year I take a look at the stuff it's recently trapped just to check, but there's never been a single valid mail.)

--
Ceterum censeo subscriptionem esse delendam.
Re:I say... by Tsu+Dho+Nimh · 2003-06-21 10:56 · Score: 2, Informative

Congratulations! You have just re-invented SPEWS (spews.org).
Re:I say... by Splab · 2003-06-21 11:02 · Score: 1

Not quite same application, but I know alot of major firms uses 2 bogus email addies to block virus from internal messagesystems (an address starteing with 0 and one with a couple of zz to make sure they are in each end) - Maybe its possible to do the same thing for spam?
Re:I say... by Anonymous Coward · 2003-06-21 11:46 · Score: 0

Even better, float email addresses of Al Qaeda lieutenants and Uday Hussein. It's a win-win, and the spammers get investigated for contacting the enemy.
Re: I say... by JDevers · 2003-06-21 12:07 · Score: 2, Interesting

BrightMail definitely DOES have false positives. At my summer job (last summer, this year I am covered by assistantship :) as tech support at an ISP that used BrightMail I don't remember a week going by without someone complaining that our spam filter had caught some of their legit mail. Most of these were borderline spam but a sizable chunk were perfectly normal mail that had no "spamness."
Re: I say... by gidds · 2003-06-21 12:19 · Score: 2, Interesting
I find that very strange, for two reasons:
1. In my experience, it's caught spams probably into 5 figures by now, of which I've personally checked probably over a thousand, absolutely none of which were spam.Â And
2. BrightMail's method can only find spam.Â Their honeypots have absolutely no legitimate use, so all the mail they get must be spam: untargetted, mass mailing, to an unchecked, harvested list of addresses.Â Assuming BrightMail then blocks only those mails, then I don't see how it can be blocking legitimate mail as well.
Are you sure we're talking about the same system?Â Maybe your ISP used some other filtering as well as BrightMail?
--
Ceterum censeo subscriptionem esse delendam.
Re: I say... by Anonymous Coward · 2003-06-21 13:07 · Score: 0

My email provider recentlly implemented BrightMail and it was getting false positives on email to me. These were mailing lists and email from friends and family. It was not spam like at all. I was rather upset considering how much I pay for that address.
Re:I say... by bovinewasteproduct · 2003-06-21 14:41 · Score: 2, Informative

Huh?

No, spews is only based on reports to a news group and some unknown persons responses to those reports.

Talk about false positives. When you block entire class C networks, you are going to get false positives. I can find a network listed with them, and send email to from a machine on that network (that has NEVER sent spam before) and spews will block it. Was my email spam? NO, therefore it's a false positive.

Plus when it takes over 6 months to get a network removed (if not longer), it is just about worthless.

BWP
Re:I say... by Max+Threshold · 2003-06-21 14:59 · Score: 1

Isn't that why there are newsgroups like alt.sex.unix? A newsreader could assume anything posted there is spam and filter similar messages from other groups.

What, that isn't the reason?

*ahem* I'll be going now...
Re:I say... by Tsu+Dho+Nimh · 2003-06-21 23:10 · Score: 1

"I can find a network listed with them, and send email to from a machine on that network (that has NEVER sent spam before) and spews will block it."
Mail may be blocked by ISPs referring to the SPEWS listings and deciding whether to let an email pass or not. But SPEWS itself does nothing to the stream of email. SPEWS does not block anything.
SPEWS publishes a listing of IP addresses that have been used to send spam to its bait addresses, and IP addresses of spam-friendly ISPs. If someone spams SPEWS, they complain to the spammer's ISP. If an ISP doesn't respond to complaints about their spammer by making the spam stop, SPEWS increases the size of the listing. This may mean that IP addresses used by non-spammers is listed, but that's the whole idea - make the ISP's custome4rsaware that they are living in a bad neighborhood. If an ISP moves a spammer to evade the listing, the listing increases to include the new addresses. This goes on until the ISP's address space is either completely listed or it starts to notice complaints from its non-spamming customers in the blocked address space.
Listing only the IP addresses of spammers was tried (see MAPS), and it let the ISP keep the spammer without its non-spamming customers noticing ... there was no incentive to get rid of them. Increasing the listing size until the ISP wakes up and smells the spam seems to be fairly effective, judging from the hysterical way the spammers attack SPEWS.
Re: I say... by Scarblac · 2003-06-22 01:07 · Score: 1

BrightMail's method can only find spam. Their honeypots have absolutely no legitimate use, so all the mail they get must be spam: untargetted, mass mailing, to an unchecked, harvested list of addresses.

Ok, so they have 100% certain spam mail examples. How do they then use them to block new mail? Do they block the From:? That can be forged, and is often a real innocent person. Do they block the IP? That may well be a normal mail server. Etc.

This is just a naive thought, but I was wondering how they solved this.

--
I believe posters are recognized by their sig. So I made one.
Re:I say... by kasperd · 2003-06-22 03:14 · Score: 1

Like razor?

--

Do you care about the security of your wireless mouse?
Re: I say... by gidds · 2003-06-22 03:20 · Score: 1

How do they then use them to block new mail?
Ah.Â That I don't know.Â And of course that's the bit that's susceptible to errors.Â
As I said, I haven't noticed a single false positive in the mail it's trapped for me.Â If it possible that different ISPs use BrightMail's info in different ways?Â Is it too late to ask if anyone knows any more about this?

--
Ceterum censeo subscriptionem esse delendam.
Re:I say... by bovinewasteproduct · 2003-06-22 21:13 · Score: 1

SPEWS does not block anything.

So what your saying is if someone uses a gun to kill someone, then that person has not killed someone, the gun has?

Can't have it both ways.

If it qucks like a duck and looks like a duck, most likely is will S*IT like a duck...

BWP
Re:I say... by Tsu+Dho+Nimh · 2003-06-23 00:51 · Score: 1

The decision to kill comes from the person who kills. They can decide to use a gun, knife, rope, or their bare hands ... until they decide to do it, nothing happens. I don't fear that my knives will hurl themselves at me as I walk through the kitchen.
SPEWS is an anti-spam defense, but it has no mechanism to put itself into the hands of the ISP, no way to block sending of email, nor any way to place itself between the sender and recipient unless the recipient has actively sought it out. The decision to use or not use SPEWS to block spam is in the hands of the ISP.
If you find SPEWS blocks essential email, you don't use it. It's that simple.

This isn't a new idea by Anonymous Coward · 2003-06-21 09:51 · Score: 1, Informative

In fact, it's been covered on Slashdot for a while. You can also set up similar honeypots for bad web robots in general (where they get 403 after a certain number of bad hits).

But what can you do about it? by Tuxinatorium · 2003-06-21 09:52 · Score: 4, Insightful

Unfortunately, there is still no law against email harvesting, so there is nothing you can do to them unless you want a little vigilante justice.

--
Repeal the DMCA!

Re:But what can you do about it? by Jason1729 · 2003-06-21 09:57 · Score: 1

Include a notice on the page that prohibits harvesters from using your page, then sue them for license violations.

Jason
ProfQuotes
Re:But what can you do about it? by Anonymous Coward · 2003-06-21 09:57 · Score: 1, Interesting

Use it to build blacklists. Any email coming from addressed formatted like this can get recorded into a nice bayesian filter as more known spam.
Re:But what can you do about it? by panaceaa · 2003-06-21 10:04 · Score: 2, Interesting

While there's no way to pursue email harvesters through legal channels, there's other ways this technique is useful.

In the example given, the spam harvester used a unique User-Agent string and a constant IP address for spidering. As a web site owner, you could block requests based on either of those credentials. In addition, you can publish your findings so that other web sites and networks can block the harvesters you find too.

You can also complain to the harvester's ISP. Since spam is often sent with open relays, you can't track down spammers through email headers. But by recording the IP address that harvested your email address, you know the initial source of the spam. The email address gives you a point of contact to start complaining to ISPs and possibly track down spammer's marketing site.

--
my blog
Re:But what can you do about it? by Restil · 2003-06-21 10:10 · Score: 1

In many places, spam itself isn't illegal either, however most ISPs worth their salt will glady rid themselves of customers that spam, and I would imagine they would be willing to do the same to harvesters. Of course, this isn't as cut&dry as reporting a spam, since you won't have the ever-so-informative email headers to provide evidence, but if enough individual reports come in, it would probably be effective.

-Restil

--
Play with my webcams and lights here
Re:But what can you do about it? by gilesjuk · 2003-06-21 10:21 · Score: 1, Funny

True, however no website has a guarantee that you have to serve them with any data or pages.
Re:But what can you do about it? by Anonymous Coward · 2003-06-21 10:34 · Score: 3, Interesting

Nah, just put up a WebPoison page and spoil their ill gotten gains by fooling the harvesters into grabbing lots of apparently valid (tho very fake) email addresses. If enough of their customers get pissed for being sold bad email lists, eventually the problem will be lessened. http://www.monkeys.com/wpoison/ "So the basic idea behind Wpoison is to trap unwary and badly engineered address harvesting web crawlers, and to fool them into adding enormous quantities of completely bogus e-mail addresses to the E-mail address data bases of the spammers, thus polluting those data bases so badly that they become essentially useless, thereby putting the spammers who are using them out of business, or at least shutting them down for a time and causing them some major headaches while they try to clean up the messes in their now-heavily-polluted e-mail address data bases." "...if one of these spammer address harvesting web crawlers is left to try to digest your entire web site, say, overnight, then within a few hours (and certainly by morning) its data base of e-mail addresses will have been well and throughly polluted by millions of utterly bogus e-mail addresses..."
Re:But what can you do about it? by sebmol · 2003-06-21 10:47 · Score: 1

I doubt such a notice has any legal bearing, not to mention that you have to show actual damages as a consequence of their action.

--
"Light is faster than sound." - "Is that why people tend to look bright until you hear them speak?"
Re:But what can you do about it? by AndroidCat · 2003-06-21 10:50 · Score: 2, Interesting

WebPoison has been around for a while, so I wouldn't be surprised if spamware can detect and filter wpoison pages. (Barring a wpoison tweak to fool that spamware, followed by a tweak of the spamware, etc.)

--
One line blog. I hear that they're called Twitters now.
Re:But what can you do about it? by Anonymous Coward · 2003-06-21 10:52 · Score: 0

it is against the law in the UK - it's a breach of the Data Protection Act. There are similar laws in most of the rest of the EU.

Not that this helps you unless the harvester is in the EU.
Re:But what can you do about it? by Anonymous Coward · 2003-06-21 11:57 · Score: 0

Isn't harvesting spammer addresses too?
Re:But what can you do about it? by c_g_hills · 2003-06-21 12:06 · Score: 1

Also see mod_spam_die.
Re:But what can you do about it? by Anonymous Coward · 2003-06-21 15:58 · Score: 0

You could put that IP into a blackhole like all those blackhole email lists...
Re:But what can you do about it? by ag0ny · 2003-06-21 17:39 · Score: 1

In the example given, the spam harvester used a unique User-Agent string and a constant IP address for spidering.

It's not so easy. What you say is true, most of them use a constant IP address. But more sofisticated spammers are now using open proxies to both harvest email addresses from websites and spam referer logs. In my domain, for example, there's one guy who's trying to spam my logs since several months ago. I receive several hundred hits every day, each of them from a different IP address. He's using open proxies around the Net.

Right now, I see only two practical solutions for spam:

- A blacklist service like Spamhaus:

Pros: easy to setup, no maintenance.
Cons: some spam still goes through.

- A sender confirmation program like qconfirm:

Pros: no spam gets through, ever. Can be configured on a per user basis.
Cons: requires some maintenance, installation is not to easy as a blacklist.

--
My site
Re:But what can you do about it? by Anonymous Coward · 2003-06-21 19:14 · Score: 0

Better than blocking requests from that IP or user agent, make sure to give that bot even more fake addresses. They sell lists to each other. The more fake addresses they sell to each other, the less valuable their lists become and the more time they spend trying to email wrong addresses. The longer they take to spam, the better they can be identified before they get to real addresses.
Re:But what can you do about it? by blibbleblobble · 2003-06-21 23:25 · Score: 1

I have a similar system, but the problem is that it's very easy to filter for "only list email addresses on the same domain as the website", which would invalidate most of the hollings@senate.gov entries.

And there's little point listing fake addresses on your own domain, because your mailserver still has to handle them.

It might be worth using an email address on another domain if you have such a system, which should get your email address filtered out by spammers.

It's also worth considering people who filter for "reject anything listed on a page entitled *spam*", which would let them delete the fake addresses relatively easily. So if you have such a system put your own email address on it, and use a special section of the address-generator as your own contact page.

As for blacklisting any IPs (or worse, FROM: addresses) which email these special accounts, think for a moment how easy it is to blacklist other peoples' computers with such a system. One email from me, and your mailserver might be rejecting everything from hsbc.com. Tarpitting seems like a much better option, as it only inconvniences a computer which is known to be using the address.

The only real solution is to track down anybody who sends spam to you, and inform their local police station (all spammers are american, even if the IP addresses look chinese)

Anybody who wishes to make those 80 people responsible for all spam 'disappear' overnight has my full support.
Re:But what can you do about it? by Specialist2k · 2003-06-21 23:36 · Score: 1

> there is still no law against email harvesting
Maybe not in the US, but in Europe there are privacy laws which prohibit address harvesting. The main problem however is: As long as there is at least a single country which does not have such a law, address harvesters and spam operations will be run from this country. And there are many countries which do not care about privacy...
Re:But what can you do about it? by Anonymous Coward · 2003-06-22 18:32 · Score: 0

problem is that it's very easy to filter for "only list email addresses on the same domain as the website"

If they do that, why do so many posters here put NOSPAM variations in their email addresses? The majority of email addresses on the web are not on the same domain that hosts the website. Ever hear of a guestbook? That's a goldmine for a spambot.
Re:But what can you do about it? by blibbleblobble · 2003-06-22 22:16 · Score: 1

"why do so many posters here put NOSPAM variations in their email addresses?"

It's added automatically by slashdot

"Ever hear of a guestbook? That's a goldmine for a spambot."

You're right. I was referring to anybody who might want to index my site, and needed a quick way to filter the thousands (infinite number) of random.name@[microsoft.com|senate.gov|yahoo.co.|ao l.com] entries that I, and many other people, use to pad-out our contact pages.
Re:But what can you do about it? by Anonymous Coward · 2003-06-25 03:37 · Score: 0

If enough of their customers get pissed for being sold bad email lists, eventually the problem will be lessened.

You seem to be under the impression that spammers are not scum-sucking con-men.

Thinking that spammers care what happens to their customers is like thinking that con-men care about the people they're bilking their money out of.

Wow, news from March by Anonymous Coward · 2003-06-21 09:53 · Score: 0

Exciting. Glad to see Slashdot is on top of things.

i did this for a while by Neophytus · 2003-06-21 09:54 · Score: 1

I did something similar for a while but stopped because I didn't really have any use for it. Using primarily my ISP's mail service theres not much I can do to customise it. At some point I intend to set up some sort of thing that feeds into a dns blacklist, but when that will be I just don't know. Its probably already been done, but heck, its the taking part that counts. Or something like that

Nothing new by Rosco+P.+Coltrane · 2003-06-21 09:55 · Score: 4, Informative

Lots of people, including me, use different middle names or initials when applying for something in writing, by snail mail or by telephone. When junk mail comes back in the mailbox, it's easy to know what company sold your information to whom, or at least which company was the initial recipient of the bogus info and which was the last.

Old new ...

--
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash

Re:Nothing new by roalt · 2003-06-21 10:03 · Score: 1

Lots of people, including me, use different middle names or initials when applying for something in writing, by snail mail or by telephone. When junk mail comes back in the mailbox, it's easy to know what company sold your information to whom, or at least which company was the initial recipient of the bogus info and which was the last.
Not quite, I do the same thing, but you still end up with a lot of spam on the e-mail addresses you publish on your web-page, and you do not change these every day by hand. This method makes it pretty much possible to see where it's from and gives you at least some cues where they're from.
Re:Nothing new by Anonymous Coward · 2003-06-21 10:12 · Score: 0

True, my dog has his own credit card, insurance, magazines, etc...
Re:Nothing new by the+eric+conspiracy · 2003-06-21 10:39 · Score: 1, Funny

Whene I register for stuff online, I often use email addresses like sales@127.0.0.1
Re:Nothing new by Anonymous Coward · 2003-06-21 10:54 · Score: 0

I usually use no@no.com but since sometimes sites only allow one login per bogus adress and no@no.com is a pretty obviouse choice for a fake e-mail adress I sometimes have to be a little more creative.

EatShitFuckingSpammers@YourWhoreofaMother.com works pretty well.
Re:Nothing new by Anonymous Coward · 2003-06-21 11:34 · Score: 1, Informative

I do that for my name in the phonebook. My middle initial is wrong, so anything that uses it gets canned w/o opening it.
Re:Nothing new by NudeZiggy · 2003-06-21 11:38 · Score: 1

let me guess, Santos L. Halper?
Re:Nothing new by Anonymous Coward · 2003-06-21 11:40 · Score: 0

I like that. One I use is;

sendnospam@thanks.???

where ??? is 2 or three characters of a non-existant top level domain. I have yet to find a site that rejects this, though validating on this is silly since garbage can be placed on the other end too;

sendnospam@thanks.i.appreciate.it.btw.how.ru
Re:Nothing new by Nexzus · 2003-06-21 11:57 · Score: 1

I use anon@yahoo.com

The guy probably really hates me.

--
Karma: Can only be portioned out by the Cosmos.
Re:Nothing new by Anonymous Coward · 2003-06-21 12:00 · Score: 0

How about webmaster or root at the domain of whoever you are about to give an email address to.
Re:Nothing new by real+gumby · 2003-06-21 12:58 · Score: 1

Lots of people, including me, use different middle names or initials when applying for something in writing...
Why do something so hard to remember? The folks who keypunch your name in couldn't care less what you write.

So I subscribed to The Economist as "Economist Reader".
My phone bill is in the name "Phone user" (this was a little harder, but worth it).

This makes it trivial to 1>ID junk mail 2> figure out whom to ask to get it stopped and 3> get bizarre looking junk mail.
Re:Nothing new by cesspool · 2003-06-21 18:56 · Score: 1

my favorite : ucan@suckit.now
Re:Nothing new by Technician · 2003-06-21 19:28 · Score: 2, Interesting

It's been a few years ago, but I had a typo on my car registration and title. I was going to get it fixed, but within 2 days of my regestration, I got mail with the same wrong name. Then I started getting sales calls. I never fixed the registration. My vehicle registration was good for about 1/3 of my snail mail junk.

It came from places you wouldn't expect it. Sideing salesmen were the worst. I was renting an apartment at the time.

--
The truth shall set you free!

wpoison by Gothmolly · 2003-06-21 09:56 · Score: 5, Informative

Try wpoision, it's a CGI script to generate a random set of email address, infinitely deep. Very fun.

--
I want to delete my account but Slashdot doesn't allow it.

Re: wpoison by Black+Parrot · 2003-06-21 10:05 · Score: 5, Funny

> Try wpoision, it's a CGI script to generate a random set of email address, infinitely deep. Very fun.

I'm trying to invent an e-mail address that explodes if anyone tries to use it.

--
Sheesh, evil *and* a jerk. -- Jade
Re: wpoison by Jon+Abbott · 2003-06-21 10:43 · Score: 1

A friend of mine thought of something similar once -- what if you had two email addresses that had forwarding rules set to each other? In other words:

joe@abc.com auto-forwards all incoming email to joe@xyz.com
joe@xyz.com auto-forwards all incoming email to joe@abc.com

It's the classic "10 GOTO 20; 20 GOTO 10", but with email accounts. Has anyone out there tried this?

--
Slashdot's first reaction to VMware
Re: wpoison by groman · 2003-06-21 10:51 · Score: 1

We had two MS Exchange servers basically kill each other with two people exchanging "Out on vacation" messages. Not fun.
Re: wpoison by Anonymous Coward · 2003-06-21 10:58 · Score: 0

Then your e-mail servers forward e-mail back and forth until they get overloaded and die. Not much of a problem for the spammer.
Re: wpoison by CoolVibe · 2003-06-21 11:02 · Score: 1

You get a mail loop. You don't want that to happen.
Re: wpoison by qqtortqq · 2003-06-21 11:16 · Score: 1

IIRC, theres some sort of mechanism that will stop mail if it is relayed more than x times. Maybe someone can expand on that for ya. I'd look it up in the rfc, but i'm busy eating a hamburger.
Re: wpoison by Realistic_Dragon · 2003-06-21 12:25 · Score: 1

I know this was modded funny, but since it's possible to write an email address in a form that stops Qmail delivering it, it may well be possible to generate one that causes a buffer overflow or other problem in sendmail/exchange/other mail app.

It would be rather amusing to r00t a bunch of dirty spammers via this technique. Use their boxes to grab kiddie pr0n from all over the net and then tip off the feds or something.

--
Beep beep.
Re:wpoison by yog · 2003-06-21 12:31 · Score: 2, Interesting

great idea; I have a static page with thousands of random email addresses generated by this Perl script, but this wpoison is sweet; the pages seem genuine and it would keep a robot busy for a long time.

I'd like to see millions of web sites adopt this approach; then perhaps spammers would be overwhelmed by bogus email addresses and it would cost them more money to figure out ways around it, if it's even possible.

The principle is similar to the Nigerian spam baiting that some of us engage in; if thousands of us did it, these turds would simply be overwhelmed and would have to find some other way to make a living!

--
it's = "it is"; its = possessive. E.g., it's flapping its wings.
Re: wpoison by numark · 2003-06-21 13:23 · Score: 1

That doesn't hurt the spammer any. The only people it hurts are the owners of abc.com and xyz.com, who have to perpetually send email between their servers until one of them decides to give up for whatever reason. The spammer doesn't have to see any of it. Forwarding is done without any response or notification to the original sender, so the spammer just sees it as another email that got delivered and doesn't have to worry about the bandwidth that's being generated on innocent servers that's not even harming him/her.

--
Want Slashdot headlines on your site? Try SlashHead
Re: wpoison by Anonymous Coward · 2003-06-21 13:53 · Score: 0

Better idea: set the MXs for those domains to other open relays. Let them spew through each other.

For bonus points, give different answers to the MX query so that open relay #1 sends it up to open relay #2, and so on. See how far they'll loop.

Once in awhile you might set the MX back to one of your hosts just so you can look at the Received: headers to see how well it's going.
Re: wpoison by Anonymous Coward · 2003-06-21 14:46 · Score: 0

two MS Exchange servers basically kill each other

So what was the problem?
Re:wpoison by Anonymous Coward · 2003-06-21 14:49 · Score: 0

Oh my, the spammers will never find a way to, say, limit the number of addresses they harvest from a single request, or single domain, etc, etc. Nope, it's impossible. The spammers live under a rock and have no idea that such things exist. They'll never defeat these.
Re: wpoison by fshalor · 2003-06-21 15:39 · Score: 1

An even better one exists.. If you've got a box on a network without a domain and it's running sendmail, a few settings will check for the domain name FQDN until they fail. Couple this with a program which tries to send to a local aliased name. Since it can't find itself in the DNS, and since it doesn't have one, it loops in the MTA prettymuch forever spooling off errors to the postmaster account. Even frying the spools doesn't always help.

--
-=fshalor ::this post not spellchecked. move along::
Re: wpoison by Anonymous Coward · 2003-06-21 21:50 · Score: 0

The best way to take down two email servers, and some port saps email (by adding a .forward or two into the mix).
Re: wpoison by Anonymous Coward · 2003-06-21 21:52 · Score: 0

Yes, used it to kill a copy of email servers, plus some guys email accound.
(two names in the .forward + vacation + sign up for "free porn via email" )
Fun, but in the end signing someone up for alt.com is much better, esp. if you have a picture of 'em drunk "showing off" with a teddy bear.
Re: wpoison by Anonymous Coward · 2003-06-21 22:13 · Score: 0

Funny, Exchange only sends an Out of Office to each address once. It's not possible for it to cause a mail loop. Either you're wrong or lying.
Re:wpoison by invenustus · 2003-06-22 05:43 · Score: 1

Catch Bad Bots in a Bot Trap

You put a line in your robots.txt saying that bots are not allowed to access a certain directory or file. Then you put an invisible link to said directory or file on your home page. Any host that makes a request for the forbidden file is an evil bot, and gets blacklisted and/or reported to some other authority.

--
grep -ri 'should work' /usr/src/linux | wc -l
Re: wpoison by shivianzealot · 2003-06-22 09:28 · Score: 1

I'm trying to invent an e-mail address that explodes if anyone tries to use it.

I certianly wouldn't want to be near my mail server when a spammer strikes...

Though, suddently, I can't help but think a certian Utah congrescritter might be able to help you :)

--
Bored with karma, be a fan/freak
Re: wpoison by CaptainZapp · 2003-06-22 21:49 · Score: 1

I'm trying to invent an e-mail address that explodes if anyone tries to use it.
Hey! Give me a shout when your invention reaches market. I'd have a few suggestions though, that you may consider implementing:
Shoot the spammer into the knew
Shoot the spammer into the groin (for repeat offenders)
For horse laughing spammers: Let them find the decapacitatet head of their favorite horse in bead (credit to the Godfather)
Magically suck the spammer to the next food processor and draw in his arm. Then start at full throttle (should make a nice wrrr,wrrr sound)
Have the spammers savings magically converted into Enron shares

--
ich bin der musikant
mit taschenrechner in der hand
kraftwerk

Honeypot vs honey hole by Anonymous Coward · 2003-06-21 09:56 · Score: 3, Funny

Last line of the article:

title edit (6/19, 6:47am): Honeypot not "honey hole." Thanks, Cory.

What's the difference between the two? Computer geeks have experience with honeypots!

Re:Honeypot vs honey hole by Anonymous Coward · 2003-06-21 09:59 · Score: 0

title edit (6/19, 6:47am): Honeypot not "honey hole." Thanks, Cory.

I'm not letting spammers anywhere _near_ my honeyhole!!
Re:Honeypot vs honey hole by Anonymous Coward · 2003-06-21 13:57 · Score: 1, Funny

A honey hole is a pit in the ground that farmers in Certain Asian countries fill with animal and human manure. They allow it to compost a bit and use it on the crops. If you ever were in Korea in the '70s or '80s and took a shortcut across a field at night, you risked falling into one of these pungent pits of fun.

Trust me, the MP's and the medics will NOT pull you out if it was not a life threatening incident!

That's how I got my nick...

Shitbird
Re:Honeypot vs honey hole by bheerssen · 2003-06-22 03:24 · Score: 1

I think they meant "glory hole". That would make all the differ...

oh wait, this is slashdot. nevermind.

--
(Score: -1, Stupid)

Pointless by Anonymous Coward · 2003-06-21 09:57 · Score: 1, Insightful

You are just going to get a list of open proxies, comprimised windows machines, throw-away dialup addresses and so on. Useless.

Re:Pointless by KewlPC · 2003-06-21 11:29 · Score: 1

This isn't to catch the spammers. It's to catch the harvesters.
Re:Pointless by Anonymous Coward · 2003-06-21 12:57 · Score: 0

Which run from "open proxies, comprimised windows machines, throw-away dialup addresses and so on".

And the next step is........ by evil_roy · 2003-06-21 09:58 · Score: 1, Insightful

What is it? Do you politely ask the spammers / bots to stop? Why should they. You have a server, they are looking for information.

Re:And the next step is........ by rusty0101 · 2003-06-21 10:03 · Score: 1

........use the fact that they gathered information from the server to get the IP addresses they searched from blackholed.

The fact that there is no law against you collecting data does not mean that the people providing that data can't use the fact that you collected that data to prevent you from sending large volumes of e-mail to them.

Likewise this will rapidly identify open-proxy sources that may also be used to send spam at another time.

-Rusty

--
You never know...
Re:And the next step is........ by Space+cowboy · 2003-06-21 10:11 · Score: 1

That's easy. I firewall them against all incoming traffic. No more spam from them, and frankly I don't care if the originator (even if innocent) suffers. If I happen to supply something they want, they can fix their damn IT systems before they get back online to me :-)

What they're doing is not illegal, but neither is what I'm doing...

Simon

--
Physicists get Hadrons!
Re:And the next step is........ by evil_roy · 2003-06-21 10:24 · Score: 1

Yep, handy to block them from your server. I suppose I was looking for something more. Blocking annoyances via a firewall rule is hardly news. Scripting to create logs to build the rule is no more worthy.
Re:And the next step is........ by Space+cowboy · 2003-06-21 10:31 · Score: 1

Agreed it's not particularly newsworthy - been doing it for ages...

If it gets N more people to do it though, we might just make spammers lives that little bit harder :-)

Simon

--
Physicists get Hadrons!
Re:And the next step is........ by AndroidCat · 2003-06-21 11:08 · Score: 2, Interesting

If they are misbehaving bots (feed them a robots.txt too), just block their IPs and don't bother being polite. (Or feed them wpoison.)

--
One line blog. I hear that they're called Twitters now.
Re:And the next step is........ by bheerssen · 2003-06-22 03:38 · Score: 1

They are not simply looking for information. They are mining websites in order to find email addresses to send promotional offers to.

This is analogous to a junk mailer going down to city hall and getting a list of physical addresses to which to send his promotional material.

There are some important differences:

1. City hall generally will not give up the names and addresses of it's citizens to just anybody.

2. It's illegal to send unrequested solicitations for pornography, specious medical programs, and many other types of questionable material through the U.S. mail.

Maybe it should be illegal to engage in that sort of activity no matter what the delivery medium. That would at least drive the spammers offshore, which would be a victory of sorts.

--
(Score: -1, Stupid)

Spammers are pretty simple (for now) by brejc8 · 2003-06-21 09:59 · Score: 5, Interesting

I am plesently suprised that my anti-spam encoded email address still has not been spammed. And even a recent spam study found that only normal email addresses got spam.
It wouldnt take much to find and decode most of the simple spam-protected email addresses. And I dont think it would take long for the spammers to detect a system such as this and bypass it, but I dont think they will bother at the current climate.
But pretty soon I suspect we will get much cleverer email collecting tools and the problem is going to get to the scale of the virus/anti-virus stage.

--
Mouse powered Chips, Open source Processors and Lego

Re: Spammers are pretty simple (for now) by Black+Parrot · 2003-06-21 10:09 · Score: 5, Funny

> I am plesently suprised that my anti-spam encoded email address still has not been spammed. [...] It wouldnt take much to find and decode most of the simple spam-protected email addresses. [...] But pretty soon I suspect we will get much cleverer email collecting tools and the problem is going to get to the scale of the virus/anti-virus stage.

Then we'll start putting "nospam" in our real addresses!

--
Sheesh, evil *and* a jerk. -- Jade
Re:Spammers are pretty simple (for now) by BabyDave · 2003-06-21 10:19 · Score: 1

I am plesently suprised that my anti-spam encoded email address still has not been spammed.

And what address would that be then?
[Suppresses maniacal laughter]
Re: Spammers are pretty simple (for now) by Uart · 2003-06-21 10:29 · Score: 1

I already do, sort of...

I have a domain with NameZero.com that forwards email sent to various addresses to my real mailbox. Whenever I sign up for stuff online, I use the addres "Spam@BrianEwart.com", Emails recieved to this address are then filtered straight into the junk. The sites that I have given it to usually only send one email that I want to see, a confirmation, so I can just pick that one out of the trash when I know it will be there.

--

Opinionated Law Student Strikes Again!
Re:Spammers are pretty simple (for now) by Anonymous Coward · 2003-06-21 10:34 · Score: 0

It wouldnt take much to find and decode most of the simple spam-protected email addresses. Yeah, I had no problem figuring out that your e-mail adddress was actually cb@cs.man.ac.uk. It's easy.
Re:Spammers are pretty simple (for now) by rsheridan6 · 2003-06-21 10:44 · Score: 1

I think it would be fairly easy to defeat email harvesting bots even if they tried harder.. if you said things like "fooTonySoprano@bar.net (minus the New Jersey gangster)" it would be pretty hard for a bot to figure it out. It would require either a truly intelligent, pop-culture aware bot, or a really really really really big (and ever expanding) dictionary.

--
Don't drop the soap, Tommy!
Re:Spammers are pretty simple (for now) by Basehart · 2003-06-21 10:48 · Score: 1

Spam already is at the virus stage - it's completely out of control. I'm guessing if everyone stopped sending spam today there'd still be scripts out there on badly administered PC's pumping it out in ever increasing numbers for the rest of time. It's an ultra big problem already.
Re:Spammers are pretty simple (for now) by digitalhermit · 2003-06-21 10:51 · Score: 1

I have a separate email address on some of my business cards for a non-computer business. Within a few weeks of handing them out I started getting spam to the address. Since this email addy doesn't appear anywhere online on either my webpage or in any document, it must have been input from someone else. Maybe someone's digital Address Book got pilfered or whatever... I suspect some Outlook virus that harvested my address from someone's vulnerable computer. Point is that even a non-digital address is not safe.
Re:Spammers are pretty simple (for now) by Anonymous Coward · 2003-06-21 10:55 · Score: 0

Why are you being such an asshole?
Re:Spammers are pretty simple (for now) by Anonymous Coward · 2003-06-21 11:02 · Score: 0

Or someone you gave a card used your email address when they had to sign up for something. Some sociopaths would actually see this as a way to keep their inbox clean.
Re:Spammers are pretty simple (for now) by Anonymous Coward · 2003-06-21 11:03 · Score: 0

cb@cs.man.ac.uk
Re:Spammers are pretty simple (for now) by alakon · 2003-06-21 11:05 · Score: 1

Is this based on any facts whatsoever?
Most spammers live because they make a commission on the herbal viagra and the penis enlargement purchases, or the spam was sent by someone who purchased a "GAUARENTEEEDE OPTTIN LLIST!!!!!!! [sic]"
Contrary to what you said-- it is not randomly generated junk that has no commercial value. You still need humans to set up the commission deals, and receive checks. If all humans in this world were removed today, assuming the power and internet works, there would not be a continued flood of spam.
Re:Spammers are pretty simple (for now) by AndroidCat · 2003-06-21 11:16 · Score: 1

Any kind of tradeshow will automatically harvest any address you give them and sell the list. That worked for snailmail addresses because the sender still had to pay postage and materials -- so they didn't hit everyone many many times.

--
One line blog. I hear that they're called Twitters now.
Re:Spammers are pretty simple (for now) by Anonymous Coward · 2003-06-21 11:32 · Score: 0

I think the point is that there's not some great untapped customer base for "herbal viagra". It's always been the case that a very large portion of spam has no valid contact to even purchase the product.

The spam gets sent to so that spammers can bolster their stats and hook more suckers into the spam pyramid game with "validated opt-in lists", spamware, and spam services. "Duh, I get all this spam, someone must be buying."

I think it is fair to say that spam has achived virus-like sub-intelligence. It's going to continue to grow exponentionally regardless of profitibility.
Re:Spammers are pretty simple (for now) by sahonen · 2003-06-21 12:46 · Score: 1

They probably realize that if someone wants to take the trouble of anti-spam encoding an email, they probably won't respond to the spam anyway, so there's no point.

Oh, wait, that would assume that spammers are actually concerned about properly targeting their ads... All the breast enlargement emails I get throw that theory out the window. Oh well, carry on.

--
Make me a friend and I'll mod you up
Re:Spammers are pretty simple (for now) by Basehart · 2003-06-21 13:00 · Score: 1

Thanks for the clarification. You hit the nail on the head. I unfortunately snapped into spam rant mode and didn't take that magic moment to lean back, take a breath and pick my nose for a few seconds before posting.
Re: Spammers are pretty simple (for now) by mistered · 2003-06-21 13:29 · Score: 4, Interesting

Then we'll start putting "nospam" in our real addresses!
I do. I use myid-nospam@my_domain.org for news groups, dubious web site forms, etc. In several years, I've received exactly one spam at that account. It looks like many of the harvesters remove any address with "spam" in it, because they think it's likely fake (or at least harvester-proofed).
By far most of my spam comes to my old eBay account. Luckily that was myid-ebay@my_domain.org, which will soon be removed in favour of a slightly different permutation.

--
Enjoy your job, make lots of money, work within the law. Choose any two.
Re: Spammers are pretty simple (for now) by bigchris · 2003-06-21 16:34 · Score: 1

Why don't you try keeping your email address as uce@ftc.gov ?

From the FTC website:

What Can I Do With the Spam in my In-Box?

Report it to the Federal Trade Commission. Send a copy of unwanted or deceptive messages to uce@ftc.gov. The FTC uses the unsolicited emails stored in this database to pursue law enforcement actions against people who send deceptive spam email.

Let the FTC know if a "remove me" request is not honored. If you want to complain about a removal link that doesn't work or not being able to unsubcribe from a list, you can fill out the FTC's online complaint form at www.ftc.gov. Your complaint will be added to the FTC's Consumer Sentinel database and made available to hundreds of law enforcement and consumer protection agencies.

Whenever you complain about spam, it's important to include the full email header. The information in the header makes it possible for consumer protection agencies to follow up on your complaint.

Send a copy of the spam to your ISP's abuse desk. Often the email address is abuse@yourispname.com or postmaster@yourispname.com. By doing this, you can let the ISP know about the spam problem on their system and help them to stop it in the future. Make sure to include a copy of the spam, along with the full email header. At the top of the message, state that you're complaining about being spammed.

Complain to the sender's ISP. Most ISPs want to cut off spammers who abuse their system. Again, make sure to include a copy of the message and header information and state that you're complaining about spam.

Just a thought.
Re: Spammers are pretty simple (for now) by Heartz · 2003-06-21 17:14 · Score: 1

Or why not make nospam part of your email address? :)
Fastmail.fm have a domain called nospammail.net . If robots remove the nospam part .... hehehehe you get the picture.
Re: Spammers are pretty simple (for now) by blibbleblobble · 2003-06-21 23:39 · Score: 1

"Luckily that was myid-ebay@my_domain.org, which will soon be removed in favour of a slightly different permutation."

Okay, serious questions from folks at work then:

If you have x users with a firstname.lastname@domain email address each, is it possible to setup a mailserver such that firstname.lastname.*@domain reaches each person's mailboox, * being a wildcard?

I know this is possible using the 'default' account and filtering: I do this myself, but we'd need to integrate it into a 'proper' email server, with lots of people accessing their own accounts.

We use microsoft servers at the moment, but they could probably be convinced to upgrade to real software if it could solve the multiple-address problem.
Re: Spammers are pretty simple (for now) by mistered · 2003-06-22 03:01 · Score: 1

Why don't you try keeping your email address as uce@ftc.gov
Uhh, because then the FTC would get my mail instead of me?
The point is that myid-nospam is my real address, so when I post to a newsgroup someone can reply to me. The harvesters drop the address, and I'm happy and spam-free.

--
Enjoy your job, make lots of money, work within the law. Choose any two.
Re: Spammers are pretty simple (for now) by mistered · 2003-06-22 03:18 · Score: 1

It's definately possible. I know some people who use this functionality to run small personal mailing lists, by having e.g. their_id-their_list@whatever delivered to their own mailbox. From there they set up the mail to be resent to everyone on their list.
That being said, I haven't done it myself; I just have tons of entries in /etc/aliases. I'm willing to bet, though, that some Google searching will turn up more information. I'll also bet that it'll be difficult to impossible with Exchange.

--
Enjoy your job, make lots of money, work within the law. Choose any two.
Re: Spammers are pretty simple (for now) by Fjord · 2003-06-22 09:28 · Score: 1

Typically this is set up as

userid+parameter@foo.com

The exim.conf has a few lines you can uncomment to get it so that this will work.

The reason I don't do this is that I don't know how to block a specific extention. I was using jl-ng@ for newsgroups (so that I could get email replies) and once it was getting to be too much, I changed the alias to a nonaccount so that it would bounce.

--
-no broken link
Re: Spammers are pretty simple (for now) by Deven · 2003-07-01 03:59 · Score: 1

The point is that myid-nospam is my real address, so when I post to a newsgroup someone can reply to me. The harvesters drop the address, and I'm happy and spam-free.

If you're so confident that this works, why don't you make this email address visible on Slashdot? After all, studies have shown that posting your email address on a web page is far more likely to get you spammed. That might be an acid test of your theory that harvesters ignore such addresses.

Of course, don't be surprised if you start getting a flood of spam as soon as your email address is visible on slashdot!

Personally, I refuse to hide my email address -- I've been using the Internet since before spam became a problem, and I refuse to "let the spammers win" by obfuscating or hiding my address. Instead, I just deal with the flood of spam as best I can...

--

Deven
"Simple things should be simple, and complex things should be possible." - Alan Kay

So... by john_smith_45678 · 2003-06-21 10:01 · Score: 1, Interesting

What can you do with somebody's IP address (that was in the email they harvested)? Resolve it and hope email sent to abuse@theirdomain.com does something?

--
John Kerry is a Joke!

Re:So... by Anonymous Coward · 2003-06-21 14:32 · Score: 0

Or you could send an email to the FTC explaining what you did and giving them the appropriate information.

A new RBL? by astrashe · 2003-06-21 10:01 · Score: 3, Interesting

I wonder if maybe someone could create a network of honeypots, and feed the data into a database that could be accessed in real time by web servers, to deny access.

It would probably impose too much of a performance hit for a popular site, but maybe for smaller stuff -- your bio page, or whatever -- it would be appropriate.

Re:A new RBL? by AndroidCat · 2003-06-21 11:21 · Score: 1

I believe there are some people experimenting with using RBLs like SPEWS to block web access. Possibly a shout on news.admin.net-abuse.email might turn up some pointers to info.

--
One line blog. I hear that they're called Twitters now.

pro-spam legislation yet anti-DMCA? by jon_c · 2003-06-21 10:03 · Score: 1, Insightful

Come on, you can't have it both ways. You're either pro government control or against it, you can't say "these people can't have freedom because i don't like them, but don't take away my freedom because people don't like me"

-Jon

--
this is my sig.

Re:pro-spam legislation yet anti-DMCA? by Anonymous Coward · 2003-06-21 10:34 · Score: 0

"You're either pro government control or against it."

Nonsense. There are roles where government should be in control, and then some (lots of) places they have no business going. What the spam issue qualifies as is uncertain, but fairly useless anyway.
Re:pro-spam legislation yet anti-DMCA? by Zebbers · 2003-06-21 10:52 · Score: 1

ummm actually. we can have it both ways. thats the beauty of democracy.

the dmca can prevent fair use. a right most people believe they have.

most spammers are committing fraud. a crime most people believe should be punished.

sometimes I really wonder how people like you get along in the world. I highly doubt you are *one way or the other* in life. No one is.
Re:pro-spam legislation yet anti-DMCA? by RTPMatt · 2003-06-21 10:54 · Score: 1

You're either pro government control or against it, you can't say "these people can't have freedom because i don't like them, but don't take away my freedom because people don't like me"

yes, you can. infact, it is your responsibility to. this is america, we the people (through elected officals) are suppose to decide how we want to live, and what people are allow to do. what do you think laws are for? im not saying this is the way it always works, just the way its suppose to work.
Re:pro-spam legislation yet anti-DMCA? by Performer+Guy · 2003-06-21 17:36 · Score: 1

Freedom can be taken away based on immoral, anti-social or illegal behavior. We just define what behaviour we find unacceptable, outlaw it and we are perfectly capable of selectively removing freedom. Not all behaviors are equal and some are downright detrimental to the common good. Let's not hogtie ourselves because we are unable to exercise any kind of rational discernment.

So you found the harvester... by anubi · 2003-06-21 10:06 · Score: 5, Interesting

Its been my experience that even though you find out which IP the harvesting spider operated from, they only sell their harvested stuff to mass marketers, which proceed through several layers of people before ending up in the hands of those doing the mass mailings.

These guys come like a thief in the night. They load your page like any other search engine spider. Its like knowing the face of the guy who went through your neighborhood, trying every door knob in the guise of distributing an advertising flyer, then later he disclosed to other thieves, unknown to you, whose at home during the day and who is not.

Yes, its helpful in building a case, like knowing who is going through a neighborhood trying all the doors, but catching the actual guy in the act is not as easy.

Some of this spam is really getting nasty. Just two days ago, I received this spam in my box purporting to be from the fraud department of Best Buy regarding CD players some guy in New York is trying to buy with my credit card. It seemed a really professional email, except they didn't know my name, and apparently had to get my email addy from a national credit bureau agency. When the links did not point as shown, I really became leery. The whole thing was apparently a ruse to get me to log into their site and disclose all sorts of personal information, playing on my fear that if I did not do so, the fraudulent transaction would complete.

Watch out, guys. There's a lot of deception going on out there.

Any tools and techniques we make to help us find out who these little rascals are is really welcome. Being some students just got nailed for their life savings for just their involvement in sharing a few songs, I trust this same environment can be used for those involved in internet scams which often cost not just a few record sales, but often substantial, I mean really substantial, grief for the victim.

--
"Prove all things; hold fast that which is good." [KJV: I Thessalonians 5:21]

Re:So you found the harvester... by DeepRedux · 2003-06-21 10:19 · Score: 3, Informative

This scam made the NY Times today: E-Mail Swindle Uses False Report About a Swindle
Re:So you found the harvester... by grondu · 2003-06-21 10:55 · Score: 1

Karma whore time:

here

--
I'm the urban spaceman babe, but here comes the twist... I don't exist
Re:So you found the harvester... by NFNNMIDATA · 2003-06-21 11:07 · Score: 1

A friend at work got one of those over a year ago, so it's not new. I submitted it as a slashdot story in the hopes the site could get slashdotted at least, but it was of course rejected.
Re:So you found the harvester... by anubi · 2003-06-21 11:07 · Score: 1

Thanks.. I just linked over from your post and read it. Yup. That's the one I got.
It scared the bejeebies out of me when I got my email. I was reading Slashdot at the time it came in. I loaded it, saw it, and thought oh s*t... More crap for me to have to straighten out. Then I noted they did not have my name.. but somehow had my email addy.. what business in their right mind would send email of such a nature to people who they did not even know the name of? As far as that goes, what business in their right mind would ask for information again that you have already given them?
So, I went to the best buy website and they had a snippet on their front page regarding a scam, unfortunately, I could not read it as I am not running the scripting languages their website requires. I do not run it as I have security concerns concerning rogue hostile applets. So I googled for +"best buy" +"hoax" and got three reports. I read them. Yup. Thats what I got. By this time, I wasn't scared any more, my fear had mutated to pure anger.
So I switched back to Slashdot, angry as all getout and submitted the damn thing as a story. In my anger, I did not really do it right - they had something better to run, but in my mind, I was so pissed off over it that I wanted to run it past Slashdot and everyone else at that hour I could. I tried to hit the local TV news websites and tip them off to what was flying over the net at that hour. (around 9PM), but these commercial websites are useless. Its hard enough just trying to get a commercial website to load anymore unless you run the latest browser and its plug-ins. And forget trying to contact these guys on a dialup. No way can you ping them up in a minute and transfer a news tip to them, as they wanna load you up with several megabytes of useless stuff. So I tried to post to local TV channels 4, 5, 7, 9, 11, and 13 to no avail. It was an experience in frustration to see this stuff flying over the net and being helpless to share it. I thought maybe it was something like when I saw the SQL slammer worm suddenly show up.. I figured if they noted the hoax on the 10PM news, it may keep others from falling for it.
Normally I view spam as a royal pain in the arse, but when they attempt to use it to deceive me, my frustration is quickly replaced by an intense urge to see to it they can't do it again.. I guess its the same thing I feel when some varmint takes it into its head to take a bite out of me.. then I don't wanna rest until I see dead varmint.

--
"Prove all things; hold fast that which is good." [KJV: I Thessalonians 5:21]
Re:So you found the harvester... by anubi · 2003-06-21 11:14 · Score: 1

You got the same one I got... word for word.

--
"Prove all things; hold fast that which is good." [KJV: I Thessalonians 5:21]
Re:So you found the harvester... by the-build-chicken · 2003-06-21 17:50 · Score: 2, Funny

he he he...I wonder if anyone lives at that Staten Island address....or funnier yet...if the guy living at 40 Winham St got the email....[leaning out window]..."Hey...Fred...did you take my F$%#in credit card!"...lmao...news @ 4...brawl errupts in Winham St Staten Island.
Re:So you found the harvester... by Elbow+Macaroni · 2003-06-22 03:13 · Score: 1

There was a spam I got the other day from ebay. It asked me to click on the link and reenter my credit card information. But it wasn't really from ebay and the link was not ebay either.

--
-------------------------------------
Technically, we are beyond survival.
Re:So you found the harvester... by Reziac · 2003-06-22 09:41 · Score: 1

I should not be in Best Buy's customer database (unless they include all complaint mail in that, who knows) but couple days ago I got an email purporting to be from Best Buy, as a warning against the above-mentioned fraudbait. It did nothing for my trust when the obfuscated informational links therein (which contained what looked like a personal-ID hash) apparently pointed to bestbuy.com's *host*, not directly to their own site.

--
~REZ~ #43301. Who'd fake being me anyway?

Useless by Ricin · 2003-06-21 10:08 · Score: 1

It will be permanently ./'ed by lop.com within weeks

Easily defeated by BuilderBob · 2003-06-21 10:11 · Score: 2, Interesting

Surely the email harvester will just 'learn' to remove it's own IP number and possibly a date (or even better, just increment the IP number date to generate an infinite number of email addresses)

A more advanced method would probably hash the ip with the date in a non-obvious way, but it'd have to be a one-to-one mapping of IP's at least and a two way hash to retreive the IP number.

Even storing the IP number as the apache-log line (if that's possible) would work, but real addresses would always work better but would require a dummy domain (e.g a dictionary of names stuck together with ._-). But unless you encode the IP you need a lookup table from your logs which is overhead.

Of course, this still doesn't address the real problem, the people who should be traced and punished are not the spammers but the companies that use the spammers, there will always be foreign companies willing to spam for you if the law makes it illegal. Few of the spams I see are international companies (ok, most of them are porn sites which are probably just harvesters).

The first link in the story also had a link to Cyveilance, which keeps appearing in my spamcop reports as "3rd party interested in spam), apparently their a chase (suspected) copyright infringement on the web....not sure I want to help them anymore..

BB

Re:Easily defeated by Anonymous Coward · 2003-06-21 10:28 · Score: 0

A more advanced method would probably hash the ip with the date in a non-obvious way, but it'd have to be a one-to-one mapping of IP's at least and a two way hash to retreive the IP number.

Yep. A "two way hash" is called by crypto people a "block cipher". And, yes, this is how I encode the IP addresses of spammers who harvest my email address.

As it turns out, a compression function for a one-way hash can also be used as a block cipher; likewise, a block cipher can be used as the compression function of a one-way hash.
Re:Easily defeated by DMDx86 · 2003-06-21 10:31 · Score: 2, Informative

I've had problems with Cyveilance and my domains. I have a few domains that I dont use anymore, but they still point to my servers, though they dont have any records in my DNS servers.

Their robots tried to crawl those domains - they kept on querying my DNS servers for about 10 minutes straight even though there was no record for that domain on my DNS

The PHP can be a bit more efficient by Anonymous Coward · 2003-06-21 10:13 · Score: 2, Informative

And also not require register_globals be on (better for security if you can set it to "off"): <a href="mailto:<?php echo $_SERVER['REMOTE_ADDR'],'_on_',date('y_m_j_Gi'),'@ EXAMPLE.COM'; ?>" title="Go ahead, Spam me">Here is my email address</a> (Slashdot adds an extra space before example.com)

Re:woah by Anonymous Coward · 2003-06-21 10:15 · Score: 0

I didn't see any code.

Re:woah by Anonymous Coward · 2003-06-21 10:16 · Score: 0

What did you see?

fighting spam by daserver · 2003-06-21 10:18 · Score: 5, Interesting

The only email address I have on my site is blockme@mydomain and if anyone sends an email to that one they get blacklisted. Easy but effective.

Re:fighting spam by bluGill · 2003-06-21 10:25 · Score: 1

I guess you have already blocked me then, even though I've never sent spam. Someone else however has sent SPAM using my name, something I don't find out about until I get bounce messages. I know that I'm not the only person to be victom of this.
Re:fighting spam by leeward · 2003-06-21 10:44 · Score: 2, Interesting

Generally blocking is done by IP address, not email address. So when the OP receives a spam addressed to blockme, I assume his software adds the source IP address the email came from to his blocklist. So you are not blocked.
Re:fighting spam by Anonymous Coward · 2003-06-21 10:48 · Score: 0

Even that isn't good enough. Most people send email through smarthosts. When somebody spams him, he's liable to blacklist an entire ISP.
Re:fighting spam by daserver · 2003-06-21 10:54 · Score: 1

It blocks the email address. If anyone is stupid enough to mail the blockme address they should be blacklisted :)
Re:fighting spam by Anonymous Coward · 2003-06-21 12:52 · Score: 0

What kind of moron are you? Spammers often use other people's email addresses. What you are basically saying is that "if anyone is stupid enough to let spammers get their email address they should be blacklisted".
Re:fighting spam by Anonymous Coward · 2003-06-21 23:42 · Score: 0

"The only email address I have on my site is blockme@mydomain and if anyone sends an email to that one they get blacklisted. Easy but effective."

So what happens if I send an email from your colleagues at work to the blockme@ address? Can I blacklist anyone I want from your email?
Re:fighting spam by XSforMe · 2003-06-23 05:28 · Score: 1

You are basically blacklisting a large ammount of create-and-drop email addresses. Very few spammers will send you more than one message with the same return address. You might as well store the database in /dev/null.

--
My other OS is the MCP!

Even better by HeavensTrash · 2003-06-21 10:19 · Score: 1

This is probably the better way to do this, since $REMOTE_ADDR may or may not work on your php config, and... boy does he have a lot of echo statements in there

" title="Go ahead,spam me">Here is my email address

" title="Go ahead, Spam me">Here is my email address

Re:Even better by HeavensTrash · 2003-06-21 10:22 · Score: 1

Oopsie, forgot the ecode tag. Lemme try again:
<a href="mailto:<?=$_SERVER['REMOTE_ADDR'].'_on_'.dat e('y_m_j_Gi').'@example.com'?>" title="Go ahead,spam me">Here is my email address</a>

I don't know if this would work but... by Lord+Kano · 2003-06-21 10:19 · Score: 1

an idea that I had went a little something like this. You get a few dozen sysadmins together and have them create thousands of dummy email accounts, sell that list to the spammers as if they were a list of valid addresses.

Hit them where it really hurts, in their pocketbooks.

So then they have to worry about 1. getting caught running afoul of the law. 2. getting a bunch of useless email addresses. and 3. getting ripped off by the people that they fight tooth and nail to outsmart.

LK

--
"Hi. This is my friend, Jack Shit, and you don't know him." - Lord Kano

Re:I don't know if this would work but... by utd-blaze · 2003-06-21 11:11 · Score: 5, Insightful

I don't think a list of phony e-mail adresses is going to put a dent in an industry that will send an e-mail to every possible adress on a popular domain in the hopes that a small fraction of those adresses will belong to real people.

--
Do me a favor and double it!
Re:I don't know if this would work but... by Mattwolf7 · 2003-06-21 14:53 · Score: 1

Why get a few dozen sysadmins when you have Slashdot? Read my latest journal entry and join the cause!
Re:I don't know if this would work but... by LauraScudder · 2003-06-22 02:14 · Score: 1

My University had to install Spam Assassin recently. At first they were just sending get your degree online emails to random adresses. Then it was the Windows Messaging get your degree online messages. Everyone turned that off, but I guess someone's figured that there's money to be had from us, because before Spam Assassin we started getting penis enlargement etc annoying spam. I even got something in spanish, with a faked header saying it was from an address at a german university. Weird. With the lengths spammers will go to, if we don't get some legislation soon its just going to be a continuous defensive battle.

I do this by Anonymous Coward · 2003-06-21 10:20 · Score: 0

I do this; the only spammers who have harvested my email address this way are TrafficMagnet. Perhaps because the actual email-address generator has a cgi-bin in the URL, and ends with a ".cgi" suffix.

The relevent user-agent strings which spambots have used are "Mozilla/3.0 (compatible; Indy Library)" and "Zeus 2.6".

Re:I do this by Anonymous Coward · 2003-06-21 10:24 · Score: 0

Indy Library is just a generic internet library for some programming language which I forget at the moment. There are some legit things using it. Zeus 2.6 is a link farm making piece of software.
Re:I do this by Anonymous Coward · 2003-06-21 10:31 · Score: 0

That is what I figured. Both user agents are still allowed to go to the rest of my site; they just are not allowed to get my email address.

Re:woah by Anonymous Coward · 2003-06-21 10:22 · Score: 0

Not much... the site is apparently not designed for Lynx. I see [EMBED] and that's about it.

Re:woah by Anonymous Coward · 2003-06-21 10:24 · Score: 0

Dude.. its not the 1970's anymore. Get a real browser.

You can do the same with a lot of addresses by wheany · 2003-06-21 10:26 · Score: 5, Informative

You can often do this even without a throwaway domain. Many addresses can be tagged by adding a "+" (plus-sign) and anything between the user name and the @-sign.

For example wheany+sd@iki.fi, wheany+SpamTastesGood@iki.fi, wheany+glahglahglag@iki.fi, wheany+spammer.com_on_06_22_2003@iki.fi all go to the same mailbox.

Re:You can do the same with a lot of addresses by Anonymous Coward · 2003-06-21 12:52 · Score: 0

What's the matter with just wheany@iki.fi?
Re:You can do the same with a lot of addresses by wheany · 2003-06-21 13:00 · Score: 1

Nothing, I just like to know where my address has been harvested. Spam is not a big problem for me anymore, I use bayesian filtering
Re:You can do the same with a lot of addresses by M.+Silver · 2003-06-21 15:17 · Score: 2, Informative

Many addresses can be tagged by adding a "+" (plus-sign)

A startling number of sites (eBay is one, or was last I checked) refuse addresses formatted like this. Sanity-checking run amok, I assume. I've occasionally emailed site admins to point out that they're rejecting RFC-valid addresses, and the answer is invariably "Just set up a throwaway yahoo account to register then."

(My answer to *that* is invariably "Your site's not worth the trouble.")

--

Slashdot's token middle-aged housewife
Re:You can do the same with a lot of addresses by Anonymous Coward · 2003-06-21 21:39 · Score: 0

Nice. And a/the Spammer will simply discard everything from the "+" upto the "@" ...

Spammers are looking like they are blundering around like stupid morons, but they definitily are not (or rather, the programs they use, for harvesting and/or sending, are not :-)
Re:You can do the same with a lot of addresses by wheany · 2003-06-21 22:13 · Score: 1

Well, I've already gotten many spams that have the tagged address intact. And spammers should not do that anyway. A plus-sign is a valid character in the local part of the address. No-one should try to interpret it in any way.

I could have a filter that puts any mails coming to the plain address straight to the trash, since I have not used the untagged address (nearly) anywhere.

In addition to that, while the iki.fi server uses "+" as a separator, some servers could use a "-" or any other character as the separator. So you could encode the address as for example laura-jenny.elle.nora.alexandra.camilla@example.co m and have a look-up table between parts of IP-addresses and names.

Agreed...useless! by NewWaveNet · 2003-06-21 10:26 · Score: 1

From the linked article...

you guys accomplish nothing by doing this.

regardless if you know where it came from or not, the high end spammers don't relay from the same host/domain they are harvesting from, that would be stupid, you guys talk about throw away domains to harvest them, but they have tons of throw away domains to harvest you.

Posted by: the cult leader at June 21, 2003 03:13 PM

Get Rich Quick With Spam NOW! by node159 · 2003-06-21 10:36 · Score: 1

And you want me to waste my time how? Now there is an idea to make some serius money:
1) Run those honey pots on lots of different web servers.
2) Flag the spam ip's.
3) Sell black list as a service the intigrates with... you guessed it ... *ughh* Outlook
4) Make millions
5) Get capped by the spam kings
6) Die rich

What a plan!!

--
GPLv2: I want my rights, I want my phone call! DRM: What use is a phone call, if you are unable to speak?

Its called a false dichotomy by gad_zuki! · 2003-06-21 10:37 · Score: 4, Informative

> Come on, you can't have it both ways.
> You're either pro government control or against it,

Why not?

Things are rarely polar opposites. You can't just say, "Well kid, are you a communist or for a lassiez-fair market." There's tons of middle ground.
The formal name for this is the False Dichotomy. More
Extremes only really exist as abstract concepts.

Advocating regulation or laws to protect against abuse is hardly pro-DMCA.

Re:Its called a false dichotomy by Natalie's+Hot+Grits · 2003-06-21 10:51 · Score: 1

"It only takes 20 years for a liberal to become a conservative without changing a single idea." Robert Anton Wilson

I think robert has it backwards.. the quote implies that the world is slowly drifting to the left. In reality, it is drifting right(at least in america). if you could go backwards in time, he might have a point.

But then you have to take apart what liberal and conservative really mean. Some would say it means large vs small government. Others think it means government protection of human rights vs. government protection of coporate rights. Still others think it means strong yet unintrusive military vs. huge intrusive military. IMO, all this is wrong, but it is how the words are currently used. A better set of words could be compassion vs. compassionless, or maybe intelligence vs. ignorance (there is a fine line between the 4. that line is hard to determine for most people).

--
Two infinite things: your stupidity and mine. But I'm not sure about the latter. If my sig offends you, I'm sorry.
Re:Its called a false dichotomy by Anonymous Coward · 2003-06-21 11:09 · Score: 1, Insightful

Ok, we're getting way off topic here, but I just have to respond.
Take a look at what conservative really means. You'll see how Robert Anton Wilson has it exactly right. What I don't understand is how the current bunch of radical Republicans get off calling themselves conservative.
For more fun, look up liberal. It's nothing like the right wing talk show people say it is. Funny though, it's like the people I know who consider themselves liberal. Sorry about the rant.
--
Anonymous only to keep the signal to noise level for this article in check. If you really hate me, mod one of my other posts down. It wouldn't be the first revenge mod, or the last.
Re:Its called a false dichotomy by stomphead · 2003-06-21 17:11 · Score: 0

While extremes may "only really exist as abstract concepts," and people's stances on spam-related legislation can fall anywhere on a continuum, you should keep in mind that you may have to choose between either option A or B in real-life situations. If you're a legislator voting on a bill, for instance. Bills can be modified for a while, but when the bill is finalized it's probably not going to perfectly match your views. But whether or not you just barely agree enough with it or you are in gung-ho agreement, it's going to look like a "Yea" either way, and vice versa with a "Nay" vote.
So if we're talking about control vs. non-control in general, or even on just spam-related issues in general, sure, that post is making a false dichotomy, and sure, it's greatly misleading to ignore all the in-betweens. However, if someone refers to one specific piece of legislation, you might like some parts and not like others, but if someone asks you what you'd vote on it if it were in Congress, you'd have to go to one extreme or the other. (Or you could abstain, of course, but that is simply one more definite option.) Can't sit on fences all the time.
Re:Its called a false dichotomy by GnarlyNome · 2003-06-21 22:23 · Score: 1

Go back intime find what you would consider a consevitive now you would find a democrat then

--
Diplomacy is the art of saying "Nice doggie" until you can find a rock. Will Rogers

Javascript can also somewhat alleviate harvesting by pariahdecss · 2003-06-21 10:38 · Score: 1

I've been using:
function nospam(user,domain) {locationstring = "mailto:" + user + "@" + domain; window.location = locationstring;}

emailme@domain.com

This has greatly cut down on spam harvest parasites grabbing my email on sites I develop - but like anything it is not a perfect solution

spamd by Anonymous Coward · 2003-06-21 10:40 · Score: 1, Insightful

Combining this method on the web server with something like this on the mail server could be fun.

bemis
forgot his password

Payback pages by NewtonsLaw · 2003-06-21 10:42 · Score: 4, Funny

Why bother with honeypots when a Payback Page is far more satisfying :-)

Re:Payback pages by cannon_trodder · 2003-06-21 11:36 · Score: 1

Only if you post the mailbox of the real sender.

I'm guessing some of those people are just others on the SPAM list who's address was put in the reply-to field by the spammer.

Maybe there is some script out there that traces back to the real spammer... anyone got any ideas?
Re:Payback pages by PetWolverine · 2003-06-21 17:56 · Score: 1

Unfortunately, it's not possible, because you don't need an e-mail address in order to send e-mail. You can send e-mail from any address, at any time, without any sort of authentication. If you knew my address, forging it would be a simple matter of telnetting into an SMTP server and giving it the right info--meaning, my e-mail address as the sender. No password necessary.

I believe that means that spammers needn't even use e-mail addresses that exist, or are valid, or anything, as the sender. I'm not sure about that, though; some SMTP servers may at the very least do a sort of syntax check to make sure it's a valid address.

--
I found the meaning of life the other day, but I had write-only access.
Re:Payback pages by Elbow+Macaroni · 2003-06-22 03:15 · Score: 1

Your payback pages are only going to further annoy the people who's email addresses were harvested for use in sending out spam. Duh... How about posting the 800#'s that were included in the spam instead? Or the phone numbers even?

--
-------------------------------------
Technically, we are beyond survival.
Re:Payback pages by Reziac · 2003-06-22 09:44 · Score: 1

Just wait til some spammer forges *your* address in the From field, and some payback parser picks it up and adds it to a poison-email page...

--
~REZ~ #43301. Who'd fake being me anyway?

Re:Javascript can also somewhat alleviate harvesti by pariahdecss · 2003-06-21 10:42 · Score: 1

OOOOps - function nospam(user,domain) { locationstring = "mailto:" + user + "@" + domain; window.location = locationstring; } <a href="javascript:nospam('webmaster','domain.com')" >emailme@domain.com</a>

WARNING! by Anonymous Coward · 2003-06-21 10:53 · Score: 0

Nasty pictures, do NOT go there.

Giving credit where it is due... by darkpurpleblob · 2003-06-21 10:54 · Score: 4, Informative

It wasn't Mark Pilgrim that described a simple way to identify email-harvesters. The link shows it was George A. Theall in a comment on Mark Pilgrim's weblog.

How Cheese Man got mixed up is beyond me, as comment by George A. Theall is clearly displayed at the bottom of the comment.

Comment removed by account_deleted · 2003-06-21 10:55 · Score: 4, Informative

Comment removed based on user account deletion

You missed the point by Anonymous Coward · 2003-06-21 11:02 · Score: 1, Insightful

the idea behind having a throwaway domain was so that they wouldn't harvest the domain and start sending email to something like info@yourdomain.com or do a dictionary attack or something. and you would know that any and all spam sent to this domain would be spam.

it's an interesing idea but likely more for fun than any real effect

Re:You missed the point by Anonymous Coward · 2003-06-22 03:25 · Score: 0

If they're spidering your page, that means they already know your domain name.

Not that easily defeated by Space+cowboy · 2003-06-21 11:04 · Score: 1

Store /usr/dict/words in a database, or find a list of names on the web you can use
Get two words, separate them with a "." and call that the reference tag
Store the IP and the reference tag in the DB
Write the mailto: url using the reference tag as the name part of the email address.

The downside is 2 selects and an insert on a DB for every page, but most sites are database-driven now anyway, and those that aren't probably don't care about the delay...

As for getting the spammers not the harvesters, surely it's the spammers you pick up on ... every time I've had spam, I've got the IP address of the sending server in the mail headers, it's just that I have to read it to adjudge it spam ... They either use their own mailserver, or an open relay. Firewall it on port 25. End of story.

Simon.

--
Physicists get Hadrons!

What about this idea? by taozilla · 2003-06-21 11:04 · Score: 0

I have often wondered about the feasibility of setting up a national email and database to which everyone could forward their spam to. Then setting up a perl script which would strip the header information from the spam and post the information real time on a website. We could block the worst offending nets?

5-step plan: by The+Master+Control+P · 2003-06-21 11:05 · Score: 0, Redundant

1) Set up a honeypot to get info about spammers
2) WHOIS them
3) Send E-Mail saying "give me $1000 or I sign you up to every known spam list and catalog order on the planet"
4) ???
5) Profit!

Re:Best Buy Fraud by CyberDave · 2003-06-21 11:05 · Score: 1

Interestingly, I've received a few emails from Best Buy over the last couple of days to a couple of addresses I've registered with them.

They are basically anti-fruad messages saying that those fraud alert emails are not from Best Buy, they are investigating them with law enforcement officials, reiterating that their online store is safe, etc.

CyberDave

Why not do... by Splab · 2003-06-21 11:06 · Score: 1

Why go through all this trouble, just use session data and keep track of how many requests in a minute - if they pass some threshold just give them a plain text file that says you exeeded the qoute for one minute - please stop requesting so much (make better sentence). They still get to request pages and get something like a few kb worth of data - but it stops them from hoggin the real data...

Use it against them. by capt.Hij · 2003-06-21 11:22 · Score: 2, Funny

You could bite back. Instead of trying to track them how about including the email address of the postmaster at the machine calling the page. That way when a harvester at j3rk.ugh.com calls your page it sees an address postmaster@j3rk.ugh.com. The harvester then sells his own address to the spammers. Then sit back and hope that the harvester decides to try to grow his organ enough that he doesn't need to do this stuff....

Comment removed by account_deleted · 2003-06-21 11:34 · Score: 2, Insightful

Comment removed based on user account deletion

cb@cs.man.ac.uk by Anonymous Coward · 2003-06-21 11:42 · Score: 0

cb@cs.man.ac.uk

I have a "tar pit" on my website by Hollinger · 2003-06-21 12:01 · Score: 2, Interesting

You should do what I do, and set up a "tar pit" on your website, with a bunch of bogus randomly generated e-mail addresses, and links back to itself. On last count, I've handed out over 100,000 false e-mail addresses.

--
Michael C. Hollinger

mod_spam_die by c_g_hills · 2003-06-21 12:01 · Score: 5, Informative

Another tool to throw a spanner in the works for spammers is mod_spam_die for Apache. It generates a random page with recursive links and fake addresses, thus causing the spammer's database to fill up with useless addresses. There's an example at chaz6.com/spam_die.

Re:mod_spam_die by Anonymous Coward · 2003-06-21 14:52 · Score: 0

I think that it'd probably be a bit more effective if the url wasn't "spam_die", which is quite easy to program harvesting bots to ignore.

Seriously, spammers aren't dumb -- they know such things exist and can easily tell their robots what do do with them. Hell, maybe they request the pages anyway to burn up your bandwidth and make you think you're doing some good, whilst not bothering to record the false addresses you give.

another useful tactic... by mocktor · 2003-06-21 12:20 · Score: 1

can be linking to a php script which generates n random email addresses in your site. For example this. The link doesn't even have to be visible, it'd take a fairly smart harvester to notice you've stuck it behind a <div> tag or made the font appear in the background colour.

Although it isn't cutting-edge (most of the domains would fail a dns lookup for starters) it should succeed in polluting lists generated by most dumb harvesters. Crude but effective since every spam sent to a non-existent address means one less sent to a real human.

mailto by Trendy_Jay · 2003-06-21 12:24 · Score: 1

With the number of people using web based email, how usefull is the mailto tag anyway?

Re:mailto by Anonymous Coward · 2003-06-21 13:10 · Score: 0

Some mail clients can send via webmail when a mailto: is clicked. And people that only have webmail suck.

I love this whole discussion. by pair-a-noyd · 2003-06-21 12:26 · Score: 1

This is beautiful. And all the other suggestions bring joy to my heart!

I just wish someone would invent a way that sends a 100,000 volt/amp jolt back to the spammers so that all that's left to be found is a pile of smoking ashes where they were sitting when they went to check their in box...

But the postmaster doesn't care by YankeeInExile · 2003-06-21 12:56 · Score: 2, Insightful

postmaster@j3rk.ugh.com doesn't really care.

If, perchance, it is a company that makes its bread and butter collecting and selling e-mail addresses to the gullible, they probably already KNOW what they are doing, and you reminding them does nothing but give you a warm feeling.

Another option is some retail user - there probably is no postmaster@CPE0080c6ef6343-CM0143000000054.cpe.net .cable.rogers.com just to pull a random IP address out of my log file.

And finally the last case -- you hit the 'jackpot' -- you find the email address of some overworked sysadmin at medium-nsp.net who COULD do something if she could.

An anecdote to illustrate:

I was working as head network/system administration guy for a very successful NSP in the S.F. bay area in the mid 90s, when spam REALLY began to take off. We had a customer who had the domain name PASTA.COM (not really -- to preserve his anonymity I have substituted an equally common word for his).

A very vigorous spam organization was sending out tens of thousands of emails advertising their spaghetti-sauce and accessory business, directing people to call 1-800-PASTA.CO (M)

They had no relationship to our (domain-squatter) client, who did not even sell pasta products. He was just hoping that some pasta-manufacturer would give him ten large for the name.

Every day, my postmaster@... inbox would be filled with vitriolic e-mail demanding that I terminate his connectivity for violating our AUP. (Sadly, our AUP had been drafted before anyone had imagined that spam would be a problem. The closest we had was a paragraph "protection of network")

Sometimes, if I was feeling argumentative, I would correspond with these sub-people asking exactly how is this customer violating any AUP? By having a domainname that is a common five-letter english word that someone else happened to use in a piece of spam?

I had my own real job to do -- helping our customers track down and eliminate open mail relays, sending out bills for rack space, taking my turn standing in front of the idiot with the backhoe so he couldn't dig up our OC3, keeping usenet working.

Eventually, I developed a tecnique that satisfied everybody. I would send out a polite form-letter saying, "Thank you internet user for your vigilance. Please be assured that the most appropriate action is being taken immediately."

Then I moved their original message into /dev/null.

--
How does the Slashdot Effect happen given that no slashdotters ever RTFA?

harvesters by dtfinch · 2003-06-21 13:11 · Score: 1

That's a great idea.

If I ever turn to the dark side and support spam, I'll have to modify my email harvester to discard those. I actually only spent a few hours working on it, but it overcomes some email protection techniques by using a real browser to load the pages (minus images & such), allowing any email descrambling scripts to run. A way to improve it might be to have it "click" all the javascript links on the page, catching attempts to browse to an email link but not actually allowing the browser to go to another page. I suspect that one day pages will use hidden "crash browser" links to stop such email bots.

What About Open Proxies? by ewhac · 2003-06-21 13:12 · Score: 2, Insightful

So what happens under this scheme when a harvester bounces all their page requests through an open proxy? Does the recorded IP address mis-identify the proxy as the harvester?

I have Zope running on an unpublished IP address and port on one of my machines. About once a day, someone tries to reflect a connection through it, like so:

66.118.187.8 - Anonymous [30/May/2003:09:10:05 -0700] "CONNECT 64.12.136.89:25 HTTP/1.0" 404 264 "" ""

Apparently there are enough mis-configured Web proxies out there (like older RedHats running Squid) to make this type of probing worthwhile. Does this honeypot account for this?

Schwab

--
Editor, A1-AAA AmeriCaptions

Hit them in the pocketbook. Their way. by Anonymous Coward · 2003-06-21 13:15 · Score: 0

Ponder this:

The fake addresses actually bother to 'click' on the links sent to them. Do this from 'the cheap seats - cable modems' or people who need more inbound traffic to balance their loads.

Benefits:

1) The 'buy' rate drops. Alot. Hopefully to a point where the people decide spam is no longer worth it.
2) The spammers think the address is ligit.
3) The outgoing bandwith of the spammers/people who use spammers will rise.

Just using spammers to load-balance (You need more incomming traffic - keep requesting the spammers's pages) (Need outgoing traffic? Host the sites that poison the spammers boxes)

Better PHP code by Sanity · 2003-06-21 13:45 · Score: 4, Interesting

Here is some PHP code that will do something similar - it just encodes the IP address, but it does so much more efficiently - resulting in email addresses as short as "fwAAAQ@blah.com". The fwAAAQ can then be decoded using base64_decode to get back to the original IP address.

$remaddr = $_SERVER["REMOTE_ADDR"]; $ips = explode(".", $remaddr); $bst = ""; foreach($ips as $b) { $bst = $bst . chr(intval($b)); } $out = str_replace("=", "", base64_encode($bst)); echo("<a href=\"mailto:$out@blah.com\">email me!</a>");

Re:Better PHP code by Anonymous Coward · 2003-06-21 14:00 · Score: 0

Why are you using so many one time variables? And you're not storing the date. And double quotes are slower than single quotes.
Re:Better PHP code by Sanity · 2003-06-21 14:03 · Score: 1

because I was focusing on getting the output smaller - if you want to rewrite it to make it more efficient internally, then be my guest.

Another idea... by blogan · 2003-06-21 14:27 · Score: 1

Is to use some scheme to encode the IP address. Slashcode won't let me post the code here, but look at Perlmonks for an example.

rumple attack by Anonymous Coward · 2003-06-21 15:00 · Score: 0

I am not quite sure if this is the proper term for it, but
when a person attempts to brute force email addresses against smtpd, it was called a rumplestiltskin attack. Sendmail allows you to throttle that back. I just thought i would throw that in to the mix, since we are talking about harveting.

later

PHP base36 encoding of IP addy - better stealth by kobotronic · 2003-06-21 15:03 · Score: 1

<? // spam bait with host signature by sonny w. // use freely // this creates dummy email address with IP // of email harvester, but it is less obvious // than some examples posted earlier. define( "_SPAM_SIGNATURE","goatse"); // custom prefix (for your mail filter) define( "_MAIL_HOST","mydomain.com"); // your mail honeypot domain define( "_SPAM_OFFSET",131435); // whatever you like function SpamCode($IPquad) { if (ereg("([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.( [0-9]{1,3})", $IPquad, $result)) { $MyIP = _SPAM_OFFSET; // arbitrary offset to foil simple spambot honeypot detection $Multiplier = 1; // crappy workaround PHP << leftshift 32bit limitations. for ($i=0;$i<4;$i++) { $MyIP += $result[$i+1] * $Multiplier; $Multiplier *= 256; } $MyCode = base_convert($MyIP,10,36); $Email = _SPAM_SIGNATURE.$MyCode."@"._MAIL_HOST; return $Email; } } function SpamDecode($Email) { if (ereg("^"._SPAM_SIGNATURE."([0-9a-z]+)@",$Email,$r esult)) { $MyIP = base_convert($result[1],36,10) - _SPAM_OFFSET; $outIP = ""; for ($i=0;$i<4;$i++) { $outIP .= ($MyIP >> ($i*8)) % 256; if ($i<3) $outIP .= "."; } return $outIP; } } $Email = SpamCode($_SERVER['REMOTE_ADDR']); echo ($Email); // use SpamDecode(email) to decode IP from spam email ?>

Re:PHP base36 encoding of IP addy - better stealth by Anonymous Coward · 2003-06-21 15:15 · Score: 0

I apologize for being offtopic. I just need to vent.
I read an article a few months ago, not about the actual harvesters, but about spammers. What upset me the most was how much of a punk this one in particular was. The spammer they were interviewing was a kid - he was something like 13 years old. He actually had the nerve (stupidity?) to tell the reporter that he couldn't understand why anyone would be upset at receiving spam, because all they needed was to "just hit the delete key!"
Kinda like he was telling all of us, "Hey! Stop hitting yourself!" and beatin' us up with his crap. A C

Spammers already advancing by WoodstockJeff · 2003-06-21 15:07 · Score: 1

We have several specially-encoded email addresses on our web pages, and they started getting spam 2 weeks after we implemented them. Not nearly as much as the "spike" addresses (like discussed in the article) that we've inserted for well over 18 months, but 5 or 6 per week.

We started encoding the date/time/IP into spike addresses in August of 2001, and we still get hits on addresses from that month. We started obscuring contact addresses in January of this year, and those addresses get less spam than the unencoded addresses they replaced, but they do get spammed.

Let's combine some ideas here. by The+Monster · 2003-06-21 15:40 · Score: 4, Informative

Set up one or more machine names on your domain specifically for spam traps.
All email addresses on your page are munged thusly: When a computer at 123.45.67.89 requests a page containing the email address
Dr. John Q. Doe <john.doe@isp.com>
it becomes
Dr. John Q. Doe (john DOT doe A-T isp DOT com) <16552.IP.123.45.67.89@spamtrap.domain.org >
where the exact formula should be a bit vague, so as not to be easily defeated by bots, but obvious to humans
The email server for spamtrap.domain.org is Teergrube (tarpit) that locks up the spamming computer AND sends notification back to the web site to serve that IP links to a world-wide tarpit ring, so as to get the spammers as many tarpit email addresses as possible

--

[100% ISO 646 Compliant]
SVM, ERGO MONSTRO.

Re:Let's combine some ideas here. by quintessent · 2003-06-22 05:26 · Score: 1

The spamtrap idea is superb. However, any respectable spamming software would learn to recognize and avoid that domain. It would be more effective if there were many semi-anonymous domains that performed this function.

--
Donate background CPU time to fight cancer.

The cat's out of the bag: by fizbin · 2003-06-21 16:07 · Score: 1

Quoting an article in soc.motss: (from April 28th)

Lars Magne Ingebrigtsen <larzi@nospamgnus.org> writes: > But just to test out that theory, this message has the address > larzi@nospamgnus.org. If I get mail to that address without the > spammy bits, then spammers have, indeed, grown brains. Stop the presses! I just got a spam to that despammed address. "You WILL make $7,500/month or it's FREE!" They've apparently been growing brains. Probably hydroponically.

So some spammers have figured out string manipulation.

Not practical widespread by Anonymous Coward · 2003-06-21 16:35 · Score: 0

The problem with this is that the bots work off links from other pages, primarily search engines.
So to create a 'honeypot' you have to create all these useless pages (you're not going to put these email addresses on a real site!), which would be just as bad as spam.
Imagine doing a legitimate search on google, and having to wade through loads of dummy pages just designed to catch bots.

Re:Not practical widespread by Anonymous Coward · 2003-06-21 16:45 · Score: 0

Why can't you include it on a real site? Just slip in a mailto like where a normal user wouldn't find it, but a robot would.

Take it a step further by howhardcanitbetocrea · 2003-06-21 16:37 · Score: 1

I ended up somewhere that had an ASP script for doing the same thing and have altered it so that when a bad guy visits it quietly shunts them off to a page that builds dummy email addresses and recursive URLs on the fly.

Just for my own evil pleasure, it also adds postmaster@ the crawler's IP to the top of the list.

--

President ISES
(International Society for Elimination of Sigs)

ASP script for this if anyone is interested by howhardcanitbetocrea · 2003-06-21 16:43 · Score: 1

I had already written one of these types of pages in ASP and have now added some code based on the original honeypot post so that if a crawler is identified it feeds them shitloads of emails and recursive URLs. Happy to share the code.

--

President ISES
(International Society for Elimination of Sigs)

Brainstorm - don't post your email on your website by jroysdon · 2003-06-21 18:35 · Score: 2, Insightful

Only just today I posted this article about how not to get spam for users of my servers. When 97% of all spam emails within a 6 month period come from website-harvested addresses, it's pretty clear that posting your email address on a website is just plain stupid. Use a form to allow users to contact you, but never allow them to be able to get your address.

Yeah, so? by asackett · 2003-06-21 18:40 · Score: 1

This is easy enough to do. Check out my top level index (the one above this article) -- there's an email address there that delivers, and adds the delivering server to my local blacklist. It contains the harvester's (or other visitor's) email address, cheesily encoded.

Ya know what I've found? The harvester bots are almost all running on cable modems. They use them for a while, then throw them away. And they rarely, very rarely, send spam from the same host that's out harvesting. In my experience, the harvester runs on a cable modem in the US, and the spam comes from overseas, or an open relay on some network unrelated to that of the harvester.

Want to get your SMTP server blocklisted in my network? Send mail to the email address at the top of this message. ;-) But if you really want to email me, my user name in my domain is the same as my user name here. Nuthin' to it.

And not so creative ways to identify harvesters is not news.

--

Warning: This signature may offend some viewers.

In perl by staypuft · 2003-06-21 23:07 · Score: 1

use MIME::Base64; use CGI qw/:standard/; use Socket; my $email_trap = encode_base64(inet_ntoa(scalar gethostbyname(remote_host() || 'localhost'))); $email_trap =~ s/=//g; $email_trap =~ s/\n//g; print "<a href=\"mailto:$email_trap\@xyz.com\">This is a spam trap</a>"; # my $remote_addr = decode_base64( $email_trap ); improvements welcomed

--
Internet Related Technologies - http://www.irt.org

Been there, done that by ajs318 · 2003-06-22 00:06 · Score: 1

I wrote something which I called SpamJavelin which does pretty much the same thing. It's not as short as the example {it runs to 17 lines not including the tags}, but it does give you a simple function to call and mung any old e-mail address.

Still, it's nice to see other people having similar ideas ..... I say go for it. Every website should have one!

--
Je fume. Tu fumes. Nous fûmes!

Not Mark by dorward · 2003-06-22 00:14 · Score: 2, Insightful

Mark Pilgrim describes...

No he doesn't, George A. Theall does, in a comment attached to an article by Mark.

1t rea11y w0rks! by call · 2003-06-22 00:53 · Score: 1

Okay, so I must admit that spam pisses me off bigtime. Hence my own spam policy is something more like this:

Reject all incoming mail.

Okay, not quite. By default, all mail is rejected unless it comes from someone I know. If it's from someone I don't know, they get a mail telling them their mail has gone into my spam folder, and also tells them how to get it past the filter.

This works because it needs a human to read the reply email, and the best thing about it is that Apple Mail makes it deliciously easy to implement.

As if this wasn't enough, my web pages also have fake addresses that encode the harvester's IP etc. There's a bona-fide email link too, because real live people have complained at me for not having one. Of course, the email address does not appear in the text of the pages. Instead it's coded in some Javascript that renders a de-mangled mailto: link. The day that they make their harvesters interpret javascript correctly is... well... the day they leave themselves open to LOTS of malicious code on our end ;)

--
-- call

Talking about honeypots by kasperd · 2003-06-22 03:20 · Score: 2, Informative

I did a few small honeypots for the spammers to play with. SMTP and proxy.

--

Do you care about the security of your wireless mouse?

selection of fake email addy by Anonymous Coward · 2003-06-22 03:22 · Score: 1, Interesting

I would at least conver the IP address to hex (e.g. ef0f3bad) so its not really obvious what you're doing -- makes the address look more "real" too

[OT] Re:Its called a false dichotomy by Natalie's+Hot+Grits · 2003-06-22 05:59 · Score: 1

agreed. A real conservative is not what current right wingers or republicans are mostly... I will have to agree with robert, using his form of the term. Same for so called liberals.

But if we are going to talk about the true meaning of conservative, then my points change slightly. There really aren't many real conservatives left [in US, no comment on the rest], even while looking at today's liberals. "Liberals" mostly want change, or at least change of today's policy back in line with traditional values, or change in the direction of compassion to fellow individuals. And the people that call themselves conservative today mostly want radical change in government and society and in the opposite direction from traditional.

It would be easy for most of today's "Liberals" to call themselves conservative in dictionary.com's definition of the word. The only problem is not many of them will call themselves that because of all the lunatics who claim the same name, usually because they think that religious beliefs are the only "traditional" beliefs that matter, and smaller government only means larger military and law enforcement in place of compassionate government programs and reasonable laws [read: more social control and less social help]. See all the new legislation passed by so called "conservatives" for evidence. I wouldn't consider gutting the constitution as any shape or form of traditional or conservative values. The fact that our economy is dependant on war when we are at peace is some more evidence for my point.

all this IMHO of course ;)

--
Two infinite things: your stupidity and mine. But I'm not sure about the latter. If my sig offends you, I'm sorry.

Another Method by Anonymous Coward · 2003-06-22 10:14 · Score: 0

Charles Johnson is a very fine web designer and musician who runs a terrific [IMHO] weblog called Little Green Footballs.

He has a system for dealing with address harvesters which you can learn about here.

Re:Brainstorm - don't post your email on your webs by shivianzealot · 2003-06-22 11:05 · Score: 1

Or just post your email adress as a .jpg?

That's what I've done on websites I've built in the past... or at least that's what I'm saying NOW :D

--

Bored with karma, be a fan/freak

Re:Best Buy Fraud by Black+Perl · 2003-06-22 13:44 · Score: 1

They are basically anti-fruad messages saying that those fraud alert emails are not from Best Buy, they are investigating them with law enforcement officials, reiterating that their online store is safe, etc.

The anti-fraud emails are not from Best Buy either. Hope you didn't click the links.

--
bp

How I do it... by Arben · 2003-06-22 17:31 · Score: 0

Having my own domain name(s), every time I sign up for a service or download, my e-mail address with that group is something like

website@mydomain.com,
so winamp@mydomain.com, slashdot@my2nddomain.com, etc. The idea here is that you'll then know just who sold you out, and since I've started doing this, I have yet to receive any spam in the past 2 years. This furthers my theory that hotmail and aol spam or sell lists of their own users.

--
This post, like so much of Creation, is NotArt

A problem? by Anonymous+Shepard · 2003-06-22 18:21 · Score: 1

Isn't it possible that some of these auto-generated e-mail addresses will actually correspond to real addresses and thus cause innocent people to get spam they otherwise wouldn't get?

--
I have a life. I really do. I've just chosen to ignore it.

Re:Brainstorm - don't post your email on your webs by pecosdave · 2003-06-23 03:05 · Score: 1

On my old website I posted this paragraph at the bottom:

Thanks to spammers I'm not going to provide a nice simple email link. If you want to email me, I'm pecosdave at this domain. If you don't see the domain in the address bar for some reason it's geeksofrage.com so email pecosdave there.

(I had to add the last sentance to help non-geeks along, I use my family as a test bed for stuff like that)

--
The preceding post was not a Slashvertisement.

Javascript? by PhxBlue · 2003-06-23 03:49 · Score: 1

I built a Javascript function to build an e-mail address, so that the source code wouldn't contain the address but the rendered page would. I'm thinking this would stop most harvesters, since the complete address isn't even spelled out in the function's code. . .

Has anyone else done this? How does it work for you?

--
!#@%*)anks for hanging up the phone, dear.

ASP.Net solution by petele · 2003-06-23 08:33 · Score: 1

Thats a very cool idea. I wanted to try it in ASP.Net, and found I could do it using this...

<a href='mailto:<% Response.Write(Request.ServerVariables["REMOTE_ADD R"] + "_on_" + DateTime.Now.Year + "_" + DateTime.Now.Month+ "_"+DateTime.Now.Day + "_" + DateTime.Now.Hour+DateTime.Now.Minute + "@domain.com"); %>'>go ahead, spam me!</a>

I use spamex by laserone · 2003-06-24 05:14 · Score: 1

What I do is I signed up w/ spamex.com and for each email address I have to give out (for anything but personal correspondance) I create a disposeable alias. Then if/when I get spam, a) I know where it came from and, b) I can turn that alias off, thereby stopping the spam. It's low-tech but it works for me.

Let's clarify the idea here. by The+Monster · 2003-06-24 13:32 · Score: 1

It would be more effective if there were many semi-anonymous domains that performed this function.

I guess I didn't make that obvious enough when I mentioned setting up 'one or more' spam trap sub-domains. I don't literally want to specify the word 'spamtrap'

The email server for spamtrap.domain.org is Teergrube (tarpit) that locks up the spamming computer AND sends notification back to the web site to serve that IP links to a world-wide tarpit ring, so as to get the spammers as many tarpit email addresses as possible

where spamtrap can be filled in with anything the domain admin wants to use, and can even be changed from day to day if it suits his fancy

--

[100% ISO 646 Compliant]
SVM, ERGO MONSTRO.

Re:Let's clarify the idea here. by quintessent · 2003-06-24 16:50 · Score: 1

Thanks for the clarification. I think it's a great idea for slowing down spammers. Now if you could figure out a way to send an electric shock over to the spammer...

--
Donate background CPU time to fight cancer.

Seed Spambots 1.01 by Anonymous Coward · 2003-06-30 12:42 · Score: 0

This feature has been incorporated into Seed Spambots as of version 1.01. Please see http://freshmeat.net/projects/seedspambots http://freshmeat.net/projects/seedspambots

Slashdot Mirror

Honeypot For Identifying Email-Harvesters

252 comments