ietf-asrg
[Top] [All Lists]

Re: [Asrg] 2.a. Analysis - Honeypot!

2003-09-22 10:13:40
Hello Tom,

10% was just an estimation, I'll know more when I actually sit down and have
a closer look. My findings appear to be going along somewhat with yours.
However, this weekend has seen a huge increase in the number of spams to
emails from websites. They are mostly hoax updates and viruses.

I don't know if you've seen the 6 month study from CDT but their finding is
that most spam comes from email addresses posted to websites and then
newsgroups second. It's available at:

http://www.cdt.org/speech/spam/030319spamreport.shtml

I agree also about the choice of different newsgroups/mailing lists. The
evidence from the honeypot seems to support this.

regards,

Liam


----- Original Message -----
From: "Tom Thomson" <tthomson(_at_)neosinteractive(_dot_)com>
To: "Liam Meany" <meanyl(_at_)eeng(_dot_)dcu(_dot_)ie>
Sent: Monday, September 22, 2003 11:23 AM
Subject: RE: [Asrg] 2.a. Analysis - Honeypot!


That's interesting.  I've not done a proper study, or looked at anything
like as many email addresses, but my experience with about half a dozen
addresses over a long period suggests that Web exposure is pretty
unimportant.  I'm actually surprised that you have as high a figure as 10%
for email addresses becoming spam targets through being advertised on
web-pages, my experience suggests that spammers get their targets
something
like 75% from newsgroup postings and 25% from bitnet (or other mailing
list)
postings, with only a tiny number of targets obtained from web pages
(although web pages that are mailing list archives obviously confuse the
picture no end - maybe some of what I'm attributing to the mailing lists
is
actually being picked up by scanning the archive web pages).

Also, choice of newsgroups seems to matter - postings in soc.culture.*
seem
to generate much more spam that postings in comp.*, for example; similarly
choice of mailing lists.

Tom

-----Original Message-----
From: asrg-admin(_at_)ietf(_dot_)org 
[mailto:asrg-admin(_at_)ietf(_dot_)org]On Behalf Of Liam
Meany
Sent: 18 September 2003 20:28
To: Yakov Shafranovich
Cc: asrg(_at_)ietf(_dot_)org
Subject: [Asrg] 2.a. Analysis - Honeypot!


Hello Yakov,

Many thanks for the detailed reply. Point taken on the "subject"
guidelines.
Apologies to all.

A bit on my background
I'm currently working on a dissertation regarding spam - where it comes
from. To this end I've seeded 398 email addresses in various places on the
web including web pages, mailing lists and newsgroups. The honeypot is in
operation for about 3 months now and so far I have only received about 300
actual spam messages.

The major finding so far is that 80% of the spam comes from email
addresses
posted to newsgroups and only 10% from web pages, despite trying to
advertise them as much as possible with the search engines. I seems that
it
takes longer for the spammers to get email addresses from web pages or
least
that low traffic websites are not their target.

If anyone else in the group is investigating  similarly, or has any views,
I
would be happy to hear from them.

many thanks,

Liam
https://www1.ietf.org/mailman/listinfo/asrg



_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg



<Prev in Thread] Current Thread [Next in Thread>