Honeypot For Identifying Email-Harvesters

Cheese Man writes "Mark Pilgrim describes a simple way to identify email-harvesters: "In each page I serve, I include a bogus email address, encoded with the date of access as well as the host IP address ... This has allowed me to trace spam back to specific hosts and/or robots." There's even a simple one-line example done with PHP. (Thanks to BoingBoing for the links.)"

Comments

Nothing new

[Rosco P. Coltrane]

Lots of people, including me, use different middle names or initials when applying for something in writing, by snail mail or by telephone. When junk mail comes back in the mailbox, it's easy to know what company sold your information to whom, or at least which company was the initial recipient of the bogus info and which was the last.

Old new ...

wpoison

[Gothmolly]

Try wpoision, it's a CGI script to generate a random set of email address, infinitely deep. Very fun.

The PHP can be a bit more efficient

[Anonymous Coward]

And also not require register_globals be on (better for security if you can set it to "off"):

<a href="mailto:<?php echo $_SERVER['REMOTE_ADDR'],'_on_',date('y_m_j_Gi'),'@ EXAMPLE.COM'; ?>" title="Go ahead, Spam me">Here is my email address</a>

(Slashdot adds an extra space before example.com)

Re:So you found the harvester...

[DeepRedux]

This scam made the NY Times today: E-Mail Swindle Uses False Report About a Swindle

You can do the same with a lot of addresses

[wheany]

You can often do this even without a throwaway domain. Many addresses can be tagged by adding a "+" (plus-sign) and anything between the user name and the @-sign.

For example wheany+sd@iki.fi, wheany+SpamTastesGood@iki.fi, wheany+glahglahglag@iki.fi, wheany+spammer.com_on_06_22_2003@iki.fi all go to the same mailbox.

Re:You can do the same with a lot of addresses

[M. Silver]

Many addresses can be tagged by adding a "+" (plus-sign)

A startling number of sites (eBay is one, or was last I checked) refuse addresses formatted like this. Sanity-checking run amok, I assume. I've occasionally emailed site admins to point out that they're rejecting RFC-valid addresses, and the answer is invariably "Just set up a throwaway yahoo account to register then."

(My answer to *that* is invariably "Your site's not worth the trouble.")

Re:Easily defeated

[DMDx86]

I've had problems with Cyveilance and my domains. I have a few domains that I dont use anymore, but they still point to my servers, though they dont have any records in my DNS servers.

Their robots tried to crawl those domains - they kept on querying my DNS servers for about 10 minutes straight even though there was no record for that domain on my DNS

Its called a false dichotomy

[gad_zuki!]

> Come on, you can't have it both ways.
> You're either pro government control or against it,

Why not?

Things are rarely polar opposites. You can't just say, "Well kid, are you a communist or for a lassiez-fair market." There's tons of middle ground.
The formal name for this is the False Dichotomy. More
Extremes only really exist as abstract concepts.

Advocating regulation or laws to protect against abuse is hardly pro-DMCA.

Giving credit where it is due...

[darkpurpleblob]

It wasn't Mark Pilgrim that described a simple way to identify email-harvesters. The link shows it was George A. Theall in a comment on Mark Pilgrim's weblog.

How Cheese Man got mixed up is beyond me, as comment by George A. Theall is clearly displayed at the bottom of the comment.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:I say...

[Tsu Dho Nimh]

Congratulations! You have just re-invented SPEWS (spews.org).

mod_spam_die

[c_g_hills]

Another tool to throw a spanner in the works for spammers is mod_spam_die for Apache. It generates a random page with recursive links and fake addresses, thus causing the spammer's database to fill up with useless addresses. There's an example at chaz6.com/spam_die.

Re:I say...

[bovinewasteproduct]

Huh?

No, spews is only based on reports to a news group and some unknown persons responses to those reports.

Talk about false positives. When you block entire class C networks, you are going to get false positives. I can find a network listed with them, and send email to from a machine on that network (that has NEVER sent spam before) and spews will block it. Was my email spam? NO, therefore it's a false positive.

Plus when it takes over 6 months to get a network removed (if not longer), it is just about worthless.

BWP

Let's combine some ideas here.

[The Monster]

1. Set up one or more machine names on your domain specifically for spam traps.
2. All email addresses on your page are munged thusly: When a computer at 123.45.67.89 requests a page containing the email address

   Dr. John Q. Doe <john.doe@isp.com>

   it becomes

   Dr. John Q. Doe (john DOT doe A-T isp DOT com) <16552.IP.123.45.67.89@spamtrap.domain.org >

   where the exact formula should be a bit vague, so as not to be easily defeated by bots, but obvious to humans
3. The email server for spamtrap.domain.org is Teergrube (tarpit) that locks up the spamming computer AND sends notification back to the web site to serve that IP links to a world-wide tarpit ring, so as to get the spammers as many tarpit email addresses as possible

Talking about honeypots

[kasperd]

I did a few small honeypots for the spammers to play with. SMTP and proxy.