Message Board

Newbie/Basic Questions

Other bot traps on our sites

Author: R.Trevithick (7 Apr 07 10:17am)

I set up a site which includes a couple of PHP scripts to generate addresses to feed the bots. I grabbed the most popular first and last names from the Census, and create bogus addresses pointing to domains I own which have their "A" record set to 127.0.0.1 -- so when a spammer tries to use these addresses the email will never leave the spammer's server.

Because I don't know what the bots search for on a site, I've avoided all use of terms like spam, harvester, bot, and the like. I was thinking that the bot might search for such terms, and "smell" a bot-trap if they were found.

If I add a HoneyPot to my site, I will need to change this policy of mine, apparently, to include whatever the HoneyPot software displays. Does anyone thing this would decrease the effectiveness of my own bot-traps?

Also, I'm perfectly willing to donate some of those domains and sub-domains to the project, but I wonder if I can also continue to use them myself in my own traps if I do. If I donate a domain to the project, must I then stop using that domain in my own generated lists of email addresses for the bots? By the same token, might I be able to use some of the other donated addresses in my own bot traps?

From my current reading of this site, I believe the answer would be no. If I donate a domain, I can no longer include that domain in any bot traps I create myself. And I won't be able to use any other donated domains. Is that correct?

Thanks,
Bob

Re: Other bot traps on our sites

Author: M.Prince (7 Apr 07 1:46pm)

Bob:
Thanks for your questions.

We are constantly testing just the sort of questions you've asked above. In our experience, harvesters and other bots are pretty dumb (even the so-called smart ones). While they may avoid a single page that contain words like "spam," "harvester," "trap," etc., they will not avoid the whole site if they find those words or anything else suspect. Therefore, even if you include a honey pot and some bots are smart enough to recognize it, chances are they won't avoid the rest of your traps.

In terms of MXs, you are correct that we would STRONGLY prefer you not use the domains you donate in your other spam traps. Among other things, doing so would prevent you from receiving messages sent to them, which would make your own traps hard to monitor. Remember, however, that you can donate a sub domain. So you could donate:

phpot.mydomain.com

And continue to use for your own traps:

mytrap.mydomain.com

We have absolutely no problem with you doing that.

Thanks for your questions and welcome to the Project!

Matthew.

Re: Other bot traps on our sites

Author: R.Trevithick (7 Apr 07 2:41pm)

Hi Mathew,

Thanks for the quick and clear reply!

In thinking this over, I'm inclined toward working together as a part of the team, rather than just doing my own thing. So, I will be contributing my own domains and sub-domains to your project, and re-thinking how, or if, I want to continue my own bot traps.

I have the "Instant Domains" package from 1&1, which I purchased just for my bot trap project, and I've got 5 domains, and can have up to 5 sub-domains total. So I could set it up in whatever way you folks would find most helpful.

For example, right now I'm using one domain which also has 5 sub-domains, plus 4 other domains with no sub-domains. I can easily drop the sub-domain names from the one, and create new ones in any way that would work best. So you could have 5 domains, each with a single sub-domain, or any combination of 5 domain names plus 5 (total) sub-domains.

In creating the new sub-domains, do gibberish names work best, or do names which look legitimate work better? For example, in your project, would you prefer names like uc34t.example.net or would houston.example.net be preferable?

There is one complication, which is that I've let others use my domain names in their own bot traps.. so probably it would be best to give each of those a "virgin" sub-domain name. On the other hand, my own project is very new, and has only been on-line for a week or so, I believe there is only one other low-traffic site using them, and my records don't show any significant activity by bots, so the names are probably pretty clean. Not sure the best way to help out, so any suggestions would be useful.

If you let me know what your preferences are, I'll begin the process of renaming them and submitting them as public for your project.

If you have specific names you'd like but don't wish to post them here, then perhaps we should go off-channel to discuss it? I suspect spammers monitor this area just to find out what you guys are up to? :-) You have my email address used in signing up, so feel free to drop me a line if you have anything that should be said in private.

Oh, one last question.. with 1&1 shared hosting, I can run PHP scripts fine, but I'm not sure I have access to write anything to their CGI area. Will I have any problems installing your PHP HoneyPots on a 1&1 site such as this?

Regards,
Bob