Message Board

Tracking Harvesters/Spammers

Seeing a Reduction in Spam Attempts

Author: R.Cunningham (25 May 05 12:48am)

Since the day I donated MX records, I've noticed a decline in spam attempts.

In January 2005, I was receiving more than 5000 spam attempts per day to "not known" email addresses (email addresses which never existed and email addresses that had to be given up due to overwhelming spam).

In March, shortly after donating the MX records, the spam attempts dropped to below 3000 per day. Yesterday, they dropped below 1000 per day.

As I write this from Arizona with about 2 hours and 20 minutes remaining for the day, today's spam attempts are sitting at 482.

The regular legitimate email has not been affected at all, except that delivery speed has increased.

I think the spammers are slowly discovering that email addresses ending in my domain name are being used as spamtraps and are deleting those addresses from their lists. We all knew it would eventually happen anyway, but it appears to be happening rapidly with my domain. Perhaps it's due in part to my simple anti-spam website (rhetorical question)?

Post Edited (25 May 05 1:22am)

Re: Seeing a Reduction in Spam Attempts

Author: R.Cunningham (25 May 05 1:30am)

Let me clarify something I left out. I was referring to unique IP addresses per day. The actual attempts were much higher (with multiple addresses per attempt).

Re: Seeing a Reduction in Spam Attempts

Author: P.Hosting (29 Jul 05 10:56pm)

How do you have it setup? The reason that I'm asking is because I'm using canonical domains for my donated MX entries, and am debating on shifting all of my real e-mail to a [true] canonical domain that's NOT connected to Project Honey Pot.

The way I see it, if I add in 99 canonical domains and have 1 true canonical domain (with either black-holing or catch-alling), then that means that they have a 99% chance of getting listed. :-)

The only downside that I can think of that I'm trying to figure out at this point is when a virus gets a hold of a true e-mail address and starts kicking it all around the place. I had one address that couldn't be guessed, and was only known by about 5 people. One of them got a virus, my address went all over the place (it was one of those annoying e-mail worms), and boom, guess what? Now it gets spammed.

Re: Seeing a Reduction in Spam Attempts

Author: R.Cunningham (31 Jul 05 4:32am)

I don't understand the question. The pages for the honeypot are set up like the instructions say to do so.

I have a simple website, that needs updating, at http://nospam.oasiscomm.net - that deals with anti-spam policy. It's outdated in some parts and current in others.

For the record, the zombie spam attempts have stabilized at around 1000 attempts per day, with uniquie IP's at around 750 per day (simply means that some IP's attempt to spam multiple times).

On a side note, I use a different alias for every contact, which all point to a single real email address. When one of the aliases gets compromised, it gets replaced with another. I have not received a single spam message in months and neither have my few users.