Subject: Re: [Asrg] 2.a. Analysis - Honeypot!

From: "Liam Meany" <[email-masked]>
Date: Mon, 22 Sep 2003 18:10:54 +0100

Hello Tom,

10% was just an estimation, I'll know more when I actually sit down and have
a closer look. My findings appear to be going along somewhat with yours.
However, this weekend has seen a huge increase in the number of spams to
emails from websites. They are mostly hoax updates and viruses.

I don't know if you've seen the 6 month study from CDT but their finding is
that most spam comes from email addresses posted to websites and then
newsgroups second. It's available at:

http://www.cdt.org/speech/spam/030319spamreport.shtml

I agree also about the choice of different newsgroups/mailing lists. The
evidence from the honeypot seems to support this.

regards,

Liam

----- Original Message -----
From: "Tom Thomson" <[email-masked]>
To: "Liam Meany" <[email-masked]>
Sent: Monday, September 22, 2003 11:23 AM
Subject: RE: [Asrg] 2.a. Analysis - Honeypot!

> That's interesting.  I've not done a proper study, or looked at anything
> like as many email addresses, but my experience with about half a dozen
> addresses over a long period suggests that Web exposure is pretty
> unimportant.  I'm actually surprised that you have as high a figure as 10%
> for email addresses becoming spam targets through being advertised on
> web-pages, my experience suggests that spammers get their targets
something
> like 75% from newsgroup postings and 25% from bitnet (or other mailing
list)
> postings, with only a tiny number of targets obtained from web pages
> (although web pages that are mailing list archives obviously confuse the
> picture no end - maybe some of what I'm attributing to the mailing lists
is
> actually being picked up by scanning the archive web pages).
>
> Also, choice of newsgroups seems to matter - postings in soc.culture.*
seem
> to generate much more spam that postings in comp.*, for example; similarly
> choice of mailing lists.
>
> Tom
>
> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of Liam
> Meany
> Sent: 18 September 2003 20:28
> To: Yakov Shafranovich
> Cc: [email-masked]
> Subject: [Asrg] 2.a. Analysis - Honeypot!
>
>
> Hello Yakov,
>
> Many thanks for the detailed reply. Point taken on the "subject"
guidelines.
> Apologies to all.
>
> A bit on my background
> I'm currently working on a dissertation regarding spam - where it comes
> from. To this end I've seeded 398 email addresses in various places on the
> web including web pages, mailing lists and newsgroups. The honeypot is in
> operation for about 3 months now and so far I have only received about 300
> actual spam messages.
>
> The major finding so far is that 80% of the spam comes from email
addresses
> posted to newsgroups and only 10% from web pages, despite trying to
> advertise them as much as possible with the search engines. I seems that
it
> takes longer for the spammers to get email addresses from web pages or
least
> that low traffic websites are not their target.
>
> If anyone else in the group is investigating  similarly, or has any views,
I
> would be happy to hear from them.
>
> many thanks,
>
> Liam
> https://www1.ietf.org/mailman/listinfo/asrg
>

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg