Author: M.Prince (24 Mar 05 12:29pm)
If you select the option in your preferences then you get a notice every time your honey pot is the FIRST to identify a new harvester. If a previously identified harvester visits your site, but your site was not the first to identify it, then it is listed on your top-25 list. (PS - We're working on showing you more than the Top-25 for your own site. We just need to make sure it doesn't create caching issues.)
For typical honey pots, we cannot forward the messages received at your honey pot. There are a number of technical reasons for this. We are beginning to work with law enforcement, ISPs, and other groups involved in the anti-spam fight. We've found so far that these groups are more interested in reports about the space they control, rather than a raw message feed. To that end, we're working on a couple of things to give them these reports.
For example, we're building a service where ISPs can give us their AS-Macro and we'll give them a daily report if any harvesting or spam sending is going on within their IP space. Our intent is to make the service free to any ISPs that are active participants in the Project. We'll have more information on the new service up on the site shortly.
While I'm not sure if your strangely formatted addresses will be ignored by harvesters and removed by lists by spammers, we have checked our own systems. Statistically, there appears to be no preference between the various username formats we are using (e.g., john.smith, john_smith, johnasmith, jsmith, apple42, applejohn, jas48, etc...). Additionally, spammers are as likely to send to an address formed with a 3- or 4-level domain (e.g., level4.level3.example.com) as they are to send to an address formed with a typical 2-level domain.
We've submitted a paper analyzing our data to the upcoming CEAS conference (http://www.ceas.cc/). If we're accepted to that, we'll be presenting a lot of information on what addresses spammers prefer and, maybe more importantly, what addresses they avoid.