|
Author: H.User1325 (27 Oct 10 5:51pm)
My guess is yes. As for not seeing any DNS activity for the MX donated, it may be some time which may be delayed by several steps, IIUC
1. Establish the mailboxes at the donated MX - two weeks ago.
2. Someone request an additional HoneyPots which will provide email addresses going to #1- time delay unknown.
3a. The installer of the HP adds links in their pages pointing to the HP in #2
3b. Someone request QuickLinks which will point to the HP in #2 - again time delay unknown
4. A harvester collects one of the links in 3. - how long it takes a bad spider to find the link???
5. The harvester follows the link collected in #4 and "finds" an email address in the HP installed in #2. time delay ???
6. The harvester passes the email address collected in #5 to a spammer, who adds it to a list and finely used the address - this most likely is a short delay.
7. When the spam is sent, now there will be DNS activity to find out where to send the email. Will that activity be on the DNS you can see or on a copy somewhere else is unknown.
How project honey pot distributes email addresses among honey pots is not known. How QuickLinks pointing to a given honey pot are selected is also unknown.
In my experience it was several weeks between installing a HP and the first time my log files showed someone accessed it. That is only steps 2-5 above.
|
Welcome to Project Honey Pot | Login