Honeypots: Re: [mailinglists] Commercial anti-honeypot tool [2]

["KeyFocus" <support () keyfocus net>]

> Wouldn't it be easy for a honeypot to detect "Hon.eypot Hun.ter"
> simply by looking for SOCKS clients that make connection requests
> back to their own IP on port 25? For these connections, the
> honeypot could provide full SOCKS functionality.
Yes, this does works a treat in fooling "Hon.eypot Hun.ter". :-)
I did not mention it in case the author or a spammer came accross the
posting, also the reason for periods in "Hon.eypot Hun.ter".
I am sure they will work it out eventually when they come up against
honeypots that do this.
Our one will be ready in next week.

- Tom