Slashdot Mirror

← Back to Stories (view on slashdot.org)

Honeypot For Identifying Email-Harvesters

Posted by timothy on from the off-with-their-heads dept.

Cheese Man writes "Mark Pilgrim describes a simple way to identify email-harvesters: "In each page I serve, I include a bogus email address, encoded with the date of access as well as the host IP address ... This has allowed me to trace spam back to specific hosts and/or robots." There's even a simple one-line example done with PHP. (Thanks to BoingBoing for the links.)"

48 of 252 comments (clear)

  1. I say... by JoeLinux · · Score: 5, Interesting

    That there should be email addresses that the big companies "float" out onto spamming lists. When a mass email comes back with these email addresses, it's a flag that its spam, and block the whole message from going into the system. Of course, security on what those email addresses are would have to be pretty tight...

    1. Re:I say... by Eyston · · Score: 3, Interesting

      This is exactly what a lot of them do.

      I think Earthlinks Spam Blocker is using that idea.

      -Eyston

    2. Re: I say... by gidds · · Score: 3, Insightful

      BrightMail, too. My ISP uses it - it traps about 70% of my spam. The great thing is that it has no false positives, so it just shunts every spam it identifies off to a separate mailbox which you need never bother with - you don't spend time or bandwith downloading it. (A few times a year I take a look at the stuff it's recently trapped just to check, but there's never been a single valid mail.)

      --

      Ceterum censeo subscriptionem esse delendam.

    3. Re:I say... by Tsu+Dho+Nimh · · Score: 2, Informative

      Congratulations! You have just re-invented SPEWS (spews.org).

    4. Re: I say... by JDevers · · Score: 2, Interesting

      BrightMail definitely DOES have false positives. At my summer job (last summer, this year I am covered by assistantship :) as tech support at an ISP that used BrightMail I don't remember a week going by without someone complaining that our spam filter had caught some of their legit mail. Most of these were borderline spam but a sizable chunk were perfectly normal mail that had no "spamness."

    5. Re: I say... by gidds · · Score: 2, Interesting
      I find that very strange, for two reasons:
      1. In my experience, it's caught spams probably into 5 figures by now, of which I've personally checked probably over a thousand, absolutely none of which were spam. And
      2. BrightMail's method can only find spam. Their honeypots have absolutely no legitimate use, so all the mail they get must be spam: untargetted, mass mailing, to an unchecked, harvested list of addresses. Assuming BrightMail then blocks only those mails, then I don't see how it can be blocking legitimate mail as well.
      Are you sure we're talking about the same system? Maybe your ISP used some other filtering as well as BrightMail?
      --

      Ceterum censeo subscriptionem esse delendam.

    6. Re:I say... by bovinewasteproduct · · Score: 2, Informative

      Huh?

      No, spews is only based on reports to a news group and some unknown persons responses to those reports.

      Talk about false positives. When you block entire class C networks, you are going to get false positives. I can find a network listed with them, and send email to from a machine on that network (that has NEVER sent spam before) and spews will block it. Was my email spam? NO, therefore it's a false positive.

      Plus when it takes over 6 months to get a network removed (if not longer), it is just about worthless.

      BWP

  2. But what can you do about it? by Tuxinatorium · · Score: 4, Insightful

    Unfortunately, there is still no law against email harvesting, so there is nothing you can do to them unless you want a little vigilante justice.

    --
    Repeal the DMCA!
    1. Re:But what can you do about it? by panaceaa · · Score: 2, Interesting

      While there's no way to pursue email harvesters through legal channels, there's other ways this technique is useful.

      In the example given, the spam harvester used a unique User-Agent string and a constant IP address for spidering. As a web site owner, you could block requests based on either of those credentials. In addition, you can publish your findings so that other web sites and networks can block the harvesters you find too.

      You can also complain to the harvester's ISP. Since spam is often sent with open relays, you can't track down spammers through email headers. But by recording the IP address that harvested your email address, you know the initial source of the spam. The email address gives you a point of contact to start complaining to ISPs and possibly track down spammer's marketing site.

      --
      my blog
    2. Re:But what can you do about it? by Anonymous Coward · · Score: 3, Interesting

      Nah, just put up a WebPoison page and spoil their ill gotten gains by fooling the harvesters into grabbing lots of apparently valid (tho very fake) email addresses. If enough of their customers get pissed for being sold bad email lists, eventually the problem will be lessened. http://www.monkeys.com/wpoison/ "So the basic idea behind Wpoison is to trap unwary and badly engineered address harvesting web crawlers, and to fool them into adding enormous quantities of completely bogus e-mail addresses to the E-mail address data bases of the spammers, thus polluting those data bases so badly that they become essentially useless, thereby putting the spammers who are using them out of business, or at least shutting them down for a time and causing them some major headaches while they try to clean up the messes in their now-heavily-polluted e-mail address data bases." "...if one of these spammer address harvesting web crawlers is left to try to digest your entire web site, say, overnight, then within a few hours (and certainly by morning) its data base of e-mail addresses will have been well and throughly polluted by millions of utterly bogus e-mail addresses..."

    3. Re:But what can you do about it? by AndroidCat · · Score: 2, Interesting

      WebPoison has been around for a while, so I wouldn't be surprised if spamware can detect and filter wpoison pages. (Barring a wpoison tweak to fool that spamware, followed by a tweak of the spamware, etc.)

      --
      One line blog. I hear that they're called Twitters now.
  3. Nothing new by Rosco+P.+Coltrane · · Score: 4, Informative

    Lots of people, including me, use different middle names or initials when applying for something in writing, by snail mail or by telephone. When junk mail comes back in the mailbox, it's easy to know what company sold your information to whom, or at least which company was the initial recipient of the bogus info and which was the last.

    Old new ...

    --
    "A door is what a dog is perpetually on the wrong side of" - Ogden Nash
    1. Re:Nothing new by Technician · · Score: 2, Interesting

      It's been a few years ago, but I had a typo on my car registration and title. I was going to get it fixed, but within 2 days of my regestration, I got mail with the same wrong name. Then I started getting sales calls. I never fixed the registration. My vehicle registration was good for about 1/3 of my snail mail junk.

      It came from places you wouldn't expect it. Sideing salesmen were the worst. I was renting an apartment at the time.

      --
      The truth shall set you free!
  4. wpoison by Gothmolly · · Score: 5, Informative

    Try wpoision, it's a CGI script to generate a random set of email address, infinitely deep. Very fun.

    --
    I want to delete my account but Slashdot doesn't allow it.
    1. Re: wpoison by Black+Parrot · · Score: 5, Funny


      > Try wpoision, it's a CGI script to generate a random set of email address, infinitely deep. Very fun.

      I'm trying to invent an e-mail address that explodes if anyone tries to use it.

      --
      Sheesh, evil *and* a jerk. -- Jade
    2. Re:wpoison by yog · · Score: 2, Interesting

      great idea; I have a static page with thousands of random email addresses generated by this Perl script, but this wpoison is sweet; the pages seem genuine and it would keep a robot busy for a long time.

      I'd like to see millions of web sites adopt this approach; then perhaps spammers would be overwhelmed by bogus email addresses and it would cost them more money to figure out ways around it, if it's even possible.

      The principle is similar to the Nigerian spam baiting that some of us engage in; if thousands of us did it, these turds would simply be overwhelmed and would have to find some other way to make a living!

      --
      it's = "it is"; its = possessive. E.g., it's flapping its wings.
  5. Honeypot vs honey hole by Anonymous Coward · · Score: 3, Funny

    Last line of the article:

    title edit (6/19, 6:47am): Honeypot not "honey hole." Thanks, Cory.

    What's the difference between the two? Computer geeks have experience with honeypots!

  6. Spammers are pretty simple (for now) by brejc8 · · Score: 5, Interesting

    I am plesently suprised that my anti-spam encoded email address still has not been spammed. And even a recent spam study found that only normal email addresses got spam.
    It wouldnt take much to find and decode most of the simple spam-protected email addresses. And I dont think it would take long for the spammers to detect a system such as this and bypass it, but I dont think they will bother at the current climate.
    But pretty soon I suspect we will get much cleverer email collecting tools and the problem is going to get to the scale of the virus/anti-virus stage.

    --
    Mouse powered Chips, Open source Processors and Lego
    1. Re: Spammers are pretty simple (for now) by Black+Parrot · · Score: 5, Funny


      > I am plesently suprised that my anti-spam encoded email address still has not been spammed. [...] It wouldnt take much to find and decode most of the simple spam-protected email addresses. [...] But pretty soon I suspect we will get much cleverer email collecting tools and the problem is going to get to the scale of the virus/anti-virus stage.

      Then we'll start putting "nospam" in our real addresses!

      --
      Sheesh, evil *and* a jerk. -- Jade
    2. Re: Spammers are pretty simple (for now) by mistered · · Score: 4, Interesting
      Then we'll start putting "nospam" in our real addresses!

      I do. I use myid-nospam@my_domain.org for news groups, dubious web site forms, etc. In several years, I've received exactly one spam at that account. It looks like many of the harvesters remove any address with "spam" in it, because they think it's likely fake (or at least harvester-proofed).

      By far most of my spam comes to my old eBay account. Luckily that was myid-ebay@my_domain.org, which will soon be removed in favour of a slightly different permutation.

      --
      Enjoy your job, make lots of money, work within the law. Choose any two.
  7. A new RBL? by astrashe · · Score: 3, Interesting

    I wonder if maybe someone could create a network of honeypots, and feed the data into a database that could be accessed in real time by web servers, to deny access.

    It would probably impose too much of a performance hit for a popular site, but maybe for smaller stuff -- your bio page, or whatever -- it would be appropriate.

  8. So you found the harvester... by anubi · · Score: 5, Interesting
    Its been my experience that even though you find out which IP the harvesting spider operated from, they only sell their harvested stuff to mass marketers, which proceed through several layers of people before ending up in the hands of those doing the mass mailings.

    These guys come like a thief in the night. They load your page like any other search engine spider. Its like knowing the face of the guy who went through your neighborhood, trying every door knob in the guise of distributing an advertising flyer, then later he disclosed to other thieves, unknown to you, whose at home during the day and who is not.

    Yes, its helpful in building a case, like knowing who is going through a neighborhood trying all the doors, but catching the actual guy in the act is not as easy.

    Some of this spam is really getting nasty. Just two days ago, I received this spam in my box purporting to be from the fraud department of Best Buy regarding CD players some guy in New York is trying to buy with my credit card. It seemed a really professional email, except they didn't know my name, and apparently had to get my email addy from a national credit bureau agency. When the links did not point as shown, I really became leery. The whole thing was apparently a ruse to get me to log into their site and disclose all sorts of personal information, playing on my fear that if I did not do so, the fraudulent transaction would complete.

    Watch out, guys. There's a lot of deception going on out there.

    Any tools and techniques we make to help us find out who these little rascals are is really welcome. Being some students just got nailed for their life savings for just their involvement in sharing a few songs, I trust this same environment can be used for those involved in internet scams which often cost not just a few record sales, but often substantial, I mean really substantial, grief for the victim.

    --
    "Prove all things; hold fast that which is good." [KJV: I Thessalonians 5:21]

    1. Re:So you found the harvester... by DeepRedux · · Score: 3, Informative

      This scam made the NY Times today: E-Mail Swindle Uses False Report About a Swindle

    2. Re:So you found the harvester... by the-build-chicken · · Score: 2, Funny

      he he he...I wonder if anyone lives at that Staten Island address....or funnier yet...if the guy living at 40 Winham St got the email....[leaning out window]..."Hey...Fred...did you take my F$%#in credit card!"...lmao...news @ 4...brawl errupts in Winham St Staten Island.

  9. Easily defeated by BuilderBob · · Score: 2, Interesting

    Surely the email harvester will just 'learn' to remove it's own IP number and possibly a date (or even better, just increment the IP number date to generate an infinite number of email addresses)

    A more advanced method would probably hash the ip with the date in a non-obvious way, but it'd have to be a one-to-one mapping of IP's at least and a two way hash to retreive the IP number.

    Even storing the IP number as the apache-log line (if that's possible) would work, but real addresses would always work better but would require a dummy domain (e.g a dictionary of names stuck together with ._-). But unless you encode the IP you need a lookup table from your logs which is overhead.

    Of course, this still doesn't address the real problem, the people who should be traced and punished are not the spammers but the companies that use the spammers, there will always be foreign companies willing to spam for you if the law makes it illegal. Few of the spams I see are international companies (ok, most of them are porn sites which are probably just harvesters).

    The first link in the story also had a link to Cyveilance, which keeps appearing in my spamcop reports as "3rd party interested in spam), apparently their a chase (suspected) copyright infringement on the web....not sure I want to help them anymore..

    BB
    1. Re:Easily defeated by DMDx86 · · Score: 2, Informative

      I've had problems with Cyveilance and my domains. I have a few domains that I dont use anymore, but they still point to my servers, though they dont have any records in my DNS servers.

      Their robots tried to crawl those domains - they kept on querying my DNS servers for about 10 minutes straight even though there was no record for that domain on my DNS

  10. The PHP can be a bit more efficient by Anonymous Coward · · Score: 2, Informative

    And also not require register_globals be on (better for security if you can set it to "off"):

    <a href="mailto:<?php echo $_SERVER['REMOTE_ADDR'],'_on_',date('y_m_j_Gi'),'@ EXAMPLE.COM'; ?>" title="Go ahead, Spam me">Here is my email address</a>

    (Slashdot adds an extra space before example.com)

  11. fighting spam by daserver · · Score: 5, Interesting

    The only email address I have on my site is blockme@mydomain and if anyone sends an email to that one they get blacklisted. Easy but effective.

    1. Re:fighting spam by leeward · · Score: 2, Interesting

      Generally blocking is done by IP address, not email address. So when the OP receives a spam addressed to blockme, I assume his software adds the source IP address the email came from to his blocklist. So you are not blocked.

  12. You can do the same with a lot of addresses by wheany · · Score: 5, Informative

    You can often do this even without a throwaway domain. Many addresses can be tagged by adding a "+" (plus-sign) and anything between the user name and the @-sign.

    For example wheany+sd@iki.fi, wheany+SpamTastesGood@iki.fi, wheany+glahglahglag@iki.fi, wheany+spammer.com_on_06_22_2003@iki.fi all go to the same mailbox.

    1. Re:You can do the same with a lot of addresses by M.+Silver · · Score: 2, Informative

      Many addresses can be tagged by adding a "+" (plus-sign)

      A startling number of sites (eBay is one, or was last I checked) refuse addresses formatted like this. Sanity-checking run amok, I assume. I've occasionally emailed site admins to point out that they're rejecting RFC-valid addresses, and the answer is invariably "Just set up a throwaway yahoo account to register then."

      (My answer to *that* is invariably "Your site's not worth the trouble.")

      --

      Slashdot's token middle-aged housewife
  13. Its called a false dichotomy by gad_zuki! · · Score: 4, Informative

    > Come on, you can't have it both ways.
    > You're either pro government control or against it,

    Why not?

    Things are rarely polar opposites. You can't just say, "Well kid, are you a communist or for a lassiez-fair market." There's tons of middle ground.
    The formal name for this is the False Dichotomy. More
    Extremes only really exist as abstract concepts.

    Advocating regulation or laws to protect against abuse is hardly pro-DMCA.

  14. Payback pages by NewtonsLaw · · Score: 4, Funny

    Why bother with honeypots when a Payback Page is far more satisfying :-)

  15. Giving credit where it is due... by darkpurpleblob · · Score: 4, Informative
    It wasn't Mark Pilgrim that described a simple way to identify email-harvesters. The link shows it was George A. Theall in a comment on Mark Pilgrim's weblog.

    How Cheese Man got mixed up is beyond me, as comment by George A. Theall is clearly displayed at the bottom of the comment.

  16. Comment removed by account_deleted · · Score: 4, Informative

    Comment removed based on user account deletion

  17. Re:And the next step is........ by AndroidCat · · Score: 2, Interesting

    If they are misbehaving bots (feed them a robots.txt too), just block their IPs and don't bother being polite. (Or feed them wpoison.)

    --
    One line blog. I hear that they're called Twitters now.
  18. Re:I don't know if this would work but... by utd-blaze · · Score: 5, Insightful

    I don't think a list of phony e-mail adresses is going to put a dent in an industry that will send an e-mail to every possible adress on a popular domain in the hopes that a small fraction of those adresses will belong to real people.

    --
    Do me a favor and double it!
  19. Use it against them. by capt.Hij · · Score: 2, Funny

    You could bite back. Instead of trying to track them how about including the email address of the postmaster at the machine calling the page. That way when a harvester at j3rk.ugh.com calls your page it sees an address postmaster@j3rk.ugh.com. The harvester then sells his own address to the spammers. Then sit back and hope that the harvester decides to try to grow his organ enough that he doesn't need to do this stuff....

  20. Comment removed by account_deleted · · Score: 2, Insightful

    Comment removed based on user account deletion

  21. I have a "tar pit" on my website by Hollinger · · Score: 2, Interesting

    You should do what I do, and set up a "tar pit" on your website, with a bunch of bogus randomly generated e-mail addresses, and links back to itself. On last count, I've handed out over 100,000 false e-mail addresses.

    --
    Michael C. Hollinger
  22. mod_spam_die by c_g_hills · · Score: 5, Informative

    Another tool to throw a spanner in the works for spammers is mod_spam_die for Apache. It generates a random page with recursive links and fake addresses, thus causing the spammer's database to fill up with useless addresses. There's an example at chaz6.com/spam_die.

  23. But the postmaster doesn't care by YankeeInExile · · Score: 2, Insightful

    postmaster@j3rk.ugh.com doesn't really care.

    If, perchance, it is a company that makes its bread and butter collecting and selling e-mail addresses to the gullible, they probably already KNOW what they are doing, and you reminding them does nothing but give you a warm feeling.

    Another option is some retail user - there probably is no postmaster@CPE0080c6ef6343-CM0143000000054.cpe.net .cable.rogers.com just to pull a random IP address out of my log file.

    And finally the last case -- you hit the 'jackpot' -- you find the email address of some overworked sysadmin at medium-nsp.net who COULD do something if she could.

    An anecdote to illustrate:

    I was working as head network/system administration guy for a very successful NSP in the S.F. bay area in the mid 90s, when spam REALLY began to take off. We had a customer who had the domain name PASTA.COM (not really -- to preserve his anonymity I have substituted an equally common word for his).

    A very vigorous spam organization was sending out tens of thousands of emails advertising their spaghetti-sauce and accessory business, directing people to call 1-800-PASTA.CO (M)

    They had no relationship to our (domain-squatter) client, who did not even sell pasta products. He was just hoping that some pasta-manufacturer would give him ten large for the name.

    Every day, my postmaster@... inbox would be filled with vitriolic e-mail demanding that I terminate his connectivity for violating our AUP. (Sadly, our AUP had been drafted before anyone had imagined that spam would be a problem. The closest we had was a paragraph "protection of network")

    Sometimes, if I was feeling argumentative, I would correspond with these sub-people asking exactly how is this customer violating any AUP? By having a domainname that is a common five-letter english word that someone else happened to use in a piece of spam?

    I had my own real job to do -- helping our customers track down and eliminate open mail relays, sending out bills for rack space, taking my turn standing in front of the idiot with the backhoe so he couldn't dig up our OC3, keeping usenet working.

    Eventually, I developed a tecnique that satisfied everybody. I would send out a polite form-letter saying, "Thank you internet user for your vigilance. Please be assured that the most appropriate action is being taken immediately."

    Then I moved their original message into /dev/null.

    --
    How does the Slashdot Effect happen given that no slashdotters ever RTFA?
  24. What About Open Proxies? by ewhac · · Score: 2, Insightful

    So what happens under this scheme when a harvester bounces all their page requests through an open proxy? Does the recorded IP address mis-identify the proxy as the harvester?

    I have Zope running on an unpublished IP address and port on one of my machines. About once a day, someone tries to reflect a connection through it, like so:

    66.118.187.8 - Anonymous [30/May/2003:09:10:05 -0700] "CONNECT 64.12.136.89:25 HTTP/1.0" 404 264 "" ""

    Apparently there are enough mis-configured Web proxies out there (like older RedHats running Squid) to make this type of probing worthwhile. Does this honeypot account for this?

    Schwab

    --
    Editor, A1-AAA AmeriCaptions
  25. Better PHP code by Sanity · · Score: 4, Interesting
    Here is some PHP code that will do something similar - it just encodes the IP address, but it does so much more efficiently - resulting in email addresses as short as "fwAAAQ@blah.com". The fwAAAQ can then be decoded using base64_decode to get back to the original IP address.

    $remaddr = $_SERVER["REMOTE_ADDR"];
    $ips = explode(".", $remaddr);
    $bst = "";
    foreach($ips as $b) {
    $bst = $bst . chr(intval($b));
    }
    $out = str_replace("=", "", base64_encode($bst));

    echo("<a href=\"mailto:$out@blah.com\">email me!</a>");
  26. Let's combine some ideas here. by The+Monster · · Score: 4, Informative
    1. Set up one or more machine names on your domain specifically for spam traps.
    2. All email addresses on your page are munged thusly: When a computer at 123.45.67.89 requests a page containing the email address
      Dr. John Q. Doe <john.doe@isp.com>
      it becomes
      Dr. John Q. Doe (john DOT doe A-T isp DOT com) <16552.IP.123.45.67.89@spamtrap.domain.org >
      where the exact formula should be a bit vague, so as not to be easily defeated by bots, but obvious to humans
    3. The email server for spamtrap.domain.org is Teergrube (tarpit) that locks up the spamming computer AND sends notification back to the web site to serve that IP links to a world-wide tarpit ring, so as to get the spammers as many tarpit email addresses as possible
    --

    [100% ISO 646 Compliant]
    SVM, ERGO MONSTRO.

  27. Brainstorm - don't post your email on your website by jroysdon · · Score: 2, Insightful

    Only just today I posted this article about how not to get spam for users of my servers. When 97% of all spam emails within a 6 month period come from website-harvested addresses, it's pretty clear that posting your email address on a website is just plain stupid. Use a form to allow users to contact you, but never allow them to be able to get your address.

  28. Not Mark by dorward · · Score: 2, Insightful

    Mark Pilgrim describes...

    No he doesn't, George A. Theall does, in a comment attached to an article by Mark.

  29. Talking about honeypots by kasperd · · Score: 2, Informative

    I did a few small honeypots for the spammers to play with. SMTP and proxy.

    --

    Do you care about the security of your wireless mouse?