Message Board

Tracking Harvesters/Spammers

no harvesters, but spam received

Author: M.Libbey (2 Feb 05 3:10pm)

Hi folks,
Any ideas how my site can have these stats:
Harvester Visits to Your Site(s): 0
Addresses Issued on Your Site(s): 5
Spam Received at Your Addresses: 12

I'd have thought that in order for an address to have been activated (and begin receiving spam) that a harvester would have had to visit the site at least once.

Re: no harvesters, but spam received

Author: M.Prince (2 Feb 05 4:43pm)

That does seem odd, but I think it's just a quirk of hour our system caches data. Each honey pot is given a pool of available addresses from the central database. That pool is only refreshed when the honey pot begins to run low. At that time, the harvester data is also uploaded back to the database and then, at least once a day, the stats for all the honey pots get updated and that's what's displayed on your site.

Our mail servers are also independent of the database and don't necessarily update on the same schedule as the honey pots.

What I'm guessing happened is that a harvester visited your site and picked up at least one address. That address was then clobbered with spam messages. Your honey pot hasn't checked back in so the harvester visits hasn't updated yet. However, probably in the next 24 hours, your honey pot will check in and the stats should normalize.

Sorry for the confusion. I'll watch your stats and make sure nothing too funky is going on.

Re: no harvesters, but spam received

Author: L.Holloway (2 Feb 05 4:59pm)

Yup, exactly what Matthew said. I looked in the database just to confirm nothing funky was happening. You caught one of those quick harvesters -- probably running a Phish scam.

Re: no harvesters, but spam received

Author: M.Libbey (2 Feb 05 5:56pm)

Thanks! I'm amazed that it happened so quickly, and releaved to see that the javascript obfuscation I'm using for my address on the site is apparently working (ie, no spam to it) -- I couldn't tell if that was lack of site knowledge by the crawlers or their lack of javascript parsing :)