Subject: Re: [Asrg] Re: 2.a. Analysis - Honeypot!

From: Jose Marcio Martins da Cruz <[email-masked]>
Date: Mon, 22 Sep 2003 10:40:53 +0200

Hello,

Yakov Shafranovich wrote:
> 
> Terry Sullivan is involved in the analysis area and can provide some
> statistical input on this.

I'm not on that group, but I have some (imho) interesting data.

> 
> Liam Meany wrote:
> 
> > Hello Yakov,
> >
> > Many thanks for the detailed reply. Point taken on the "subject" guidelines.
> > Apologies to all.
> >
> > A bit on my background
> > I'm currently working on a dissertation regarding spam - where it comes
> > from. To this end I've seeded 398 email addresses in various places on the
> > web including web pages, mailing lists and newsgroups. The honeypot is in
> > operation for about 3 months now and so far I have only received about 300
> > actual spam messages.

On april (five months ago), I created a honeypot on our webserver : a
false e-mail address inserted in a comment at the main page of our
webserver.

Less than four hours later, we begun to receive spam on the honeypot.

Now, there are 2067 messages inside. I've just looked to it and I noted
that there are two kind of messages in : spams and virus. I've not
really counted, but it seems to me that 1/4 or something like that are
virus. Amusing ! What does this means ?

Also, if I compare, for some time period, which gateways are sending
spam to and and which gateways are sending virus to us, the intersection
is allways not empty, but has many common entries (sometimes more than
half one set)...

Regards,

Jose-Marcio

-- 
 ---------------------------------------------------------------
 Jose Marcio MARTINS DA CRUZ           Tel. :(33) 01.40.51.93.41
 Ecole des Mines de Paris              http://j-chkmail.ensmp.fr
 60, bd Saint Michel                http://www.ensmp.fr/~martins
 75272 - PARIS CEDEX 06      mailto:[email-masked]

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg