Message Board

Newbie/Basic Questions

No harvesters yet ...

Author: C.Combs (24 Feb 05 12:40am)

Just when you WANT a spammer's attention, I don't seem to be getting any. I uploaded the suggested links to several different Web pages several weeks ago, but no harvesters are showing up yet under my "stats" page. Any thoughts as to why this might be?

Re: No harvesters yet ...

Author: C.Dijkgraaf (24 Feb 05 4:31am)

Well you might have had some harvesters, but they may be collecting e-mail addresses to sell to spammers rather than use them themselves, so that takes longer.
I've had a honey pot going for over a month now and although I've had hits on the page, none have had e-mails sent yet. I'm fairly sure that some of them are actually harversters, especially since I spotted one hitting my guestbooks multiple times a day looking for e-mail addresses (but hopefully not finding any because they are javascript protected), and I've put in a redirect to the honeypage for that bot and a couple of others.

Re: No harvesters yet ...

Author: C.Combs (24 Feb 05 11:45pm)

Thanks for the reply. However, wouldn't it show that harvesters have visited my site yet on my Manage Honeypots page?

Re: No harvesters yet ...

Author: M.Prince (25 Feb 05 12:31am)

A harvester will show up if either a known-harvester IP hits your honey pot, or if an unknown IP hits and then, subsequently, sends to the address that was handed out at the visit.

Assuming that your honey pot is running and you have added links from your existing web pages, there are a lot of reasons that if a harvester visits your honey pot they may not end up actually picking up an address. For example, while our addresses are pretty good at looking normal, sometimes a spammer may just have a hunch one is not legitimate. Or maybe the spammer is only targeting email addresses with a certain ccTLD (.jp or .cn or .se or whatever).

Some honey pots we thought would immediately pick up harvester traffic have not. Others we didn't expect to pick up much at all are inundated. While the pattern is generally that higher ranked sites get more harvester traffic, there are plenty of exceptions.

Keep checking back and I'm imagine you'll see harvester traffic at some point before too long.

Re: No harvesters yet ...

Author: S.Wegner (23 Mar 05 5:35pm)

Just a note to say I am waiting for a harvester as well. I have links on every "page" in my site. Its been about 5 weeks now, and I show no visits.

Re: No harvesters yet ...but this:

Author: C.Combs (27 Mar 05 1:12am)

My "Manage Honeypot" page stats show no harvesters. However, for the first time since I have used this domain, I received some unsolicited email to my catchall address. The information is below.

I have filed a spam suit based on mortgage spam I received. After eight months, I believe I am very close to the "actual spammer" and have named them in the suit. I wonder if this is related or if I am paranoid. Any insights would be appreciated.

Received: from cust_req_fwding (4l5s@combslaw.cc --> catchall@combslaw.cc) by lmg08.affinity.com id <363412-22758>; Sat, 26 Mar 2005 21:02:47 -0800
Received: from sma01.lax.affinity.com ([172.16.20.110]) by lmg08.affinity.com with ESMTP id <359030-22754>; Sat, 26 Mar 2005 21:01:45 -0800
Received: from server007.mhp01.affinity.com (somehost.affinity.com [172.16.5.176] (may be forged)) by sma01.lax.affinity.com (8.12.11/8.12.8) with ESMTP id j2R51hqK005222 for <4l5s@combslaw.cc>; Sat, 26 Mar 2005 21:01:43 -0800
Received: (from combslaw@localhost) by server007.mhp01.affinity.com (8.11.6+Sun/8.11.6) id j2R51ZS19080; Sat, 26 Mar 2005 21:01:36 -0800 (PST)
Date: Sat, 26 Mar 2005 21:01:36 -0800 (PST)<br>
Message-Id: <200503270501.j2R51ZS19080@server007.mhp01.affinity.com>
X-Authentication-Warning: server007.mhp01.affinity.com: combslaw set sender to combslaw@combslaw.cc using -f
<br>Received: from [62.48.242.2] by www.combslaw.cc (NMS FormMail 3.11c1) with HTTP; Sun, 27 Mar 2005 05:01:35 GMT (script-name /cgi-bin/formmail.pl) (http-host www.combslaw.cc) (http-referer http://www.combslaw.cc/)
X-Mailer: NMS FormMail 3.11c1
To: 4l5s@combslaw.cc
From: combslaw@combslaw.cc
Subject: 4l5s@combslaw.cc

Below is the result of your feedback form. It was submitted by
(h8u@combslaw.cc
To: wnacyiplay@aol.com
Subject: vkVt kqv4zl sjceljia

YreN VhelYkimLu0AUSu trxly3WYqb qxatfzfRaM2bjXu nzP112r

.

) on Saturday, March 26, 2005 at 21:01:34
---------------------------------------------------------------------------

name: 4l5s@combslaw.cc
phone: 4l5s@combslaw.cc

address: 4l5s@combslaw.cc

comments: 4l5s@combslaw.cc

Submit: 4l5s@combslaw.cc

reset: 4l5s@combslaw.cc<br><br>

Re: No harvesters yet ...

Author: S.Wegner (14 Apr 05 1:28pm)

8 weeks nothing yet. I added two different lines to the footer of each page opf my Nukle site. Perhaps there is a better way? Any input appreciaited.

Re: No harvesters yet ...

Author: C.Dijkgraaf (14 Apr 05 7:53pm)

Is "Addresses Issued on Your Site(s)" increasing showing that bots are visiting that page?
If it is not then it seems no bots have found your site, including legitemate search engines.

If it is increasing but "Harvester Visits to Your Site(s)" is not, then none of the visitors have been identified as a harvester as yet. If you have access to your web logs then look through them for the visits to your honeypot page and then look at the agent name, the owner of the IP address and the behaviour of those bots, you can quite often spot potential harvesters this way. Some behaviour to look for is those that repeatedly only visit pages that contain an e-mail addresses, re visits guestbooks often, don't read your robots.txt file.