Re: Using specialized honeypots to build up-to-date spam blacklists?

[Gregory Deatz <gdeatz () hoaglandlongo com>]

Hi all,

I'm new to this list... So, hello, I guess...

I'm very interested in interesting ways to help prevent spam, and your 
idea sounds really cool except this:  Once the "spammers out there" 
figure out that poof.twinwave.net is poison, "poof.twinwave.net" would 
then be "reverse-blacklisted", so your solution would only work for a 
short while.  I think.

This solution has interesting aspects -- it sort of turns a spammer's 
tool against him, if only for a short while.

How do you propose to deal with the "attack-back" of the spammers 
eventually ignoring your poison web-page?  We normal folk have spammer 
blacklists, and spammers would have spam-poison blacklists.



Jens Knoell wrote:
> I just thought of something... so it's not totally well-thought-out yet, but
> so far the idea sounds feasible. The original idea is not from me, I just
> intend to build on a concept originally invented by a german anti-spam
> activist. What do you guys think about the following:
>
> Part one of the trap:
> I'll set up a few dummy webpages, put some useless text on it, and a little
> php script that does nothing else than generate valid-looking but basically
> invalid email addresses. I.e. the source code of the pages would contain
> ever-changing invalid addresses in there, for example <a
> href="mailto:joeuser () poof twinwave net">.</a>
>
> If I set it up right, the emails are technically there, but never visible to
> accidental visitors. Heck, I could even code in the requesting IP into the
> email address if I feel like it.
>
> This page then gets registered at various search engines, and maybe even
> updated every now and then with whatever crud I can find, to keep them from
> dropping off search engines as "dead" page. Could even be automated.
>
>
> Now to part two:
> I'll set up a mailserver for the (otherwise unused) domain
> poof.twinwave.net. Every mail to this domain gets accepted indiscriminately,
> but immediately dumped into a little parser which generates some statistics
> for personal enjoyment... AND... automatically adds the sender IP to the
> global blacklist that currently protects my mailservers.
>
>
> Sounds like a plan to get an accurate spammer list/relay list, and certainly
> sounds a lot more accurate than the current lists in use? It should be a
> piece of cake to set up, and virtually zero maintenance...
>
> If it works, I'd then go ahead and blindly forward everything that's
> @my.domains.here but not used into the parser, thus creating quite a
> respectable pool of invalid emails.
>
> As a result, spammers should have quite poisoned email databases, not to
> mention that _I_ have a nice accurate relay/spam database.
>
>
> What do you think? Anything I'm overlooking there?
>
> Jens