Simple email honey pot
While doing my previous blogs regarding procmail, I was reminded of a simple email honey pot that I have implemented on my home server. In my web pages, I have buried an email address link. The link is empty as far as the web page displays. Basically it is simply an HREF link with a "mailto" call, and then the closing anchor. So nothing shows on the web page.
What this does, however, is that when a spider crawls my web pages looking for email addresses, it will find this link. The actual address that is in the link, is one that I do not use in my domain.
Since this email is never used, or visible on the web pages, the only way that it will be found, is if someone is mining email addresses. Since the legitimate search engines and spiders do not do this, then it is being mined with the intent of sending spam to it.
So, when my server does receive an email to this hidden address, it is guaranteed to be spam. That being the case, in procmail one of my first rules is to test if the message is being sent to this address. If it is, then the message gets immediately dropped into a spam trap file. This spam trap file is used by spamassassin’s learn spam capabilities. The end result is that not only is the spam message dropped, but spamassassin is able to use it to learn more spam. The spammers are actually helping my system to learn how to keep their emails out!
Dave.