>> Each visitor is given a different email address. It's made up of their
>> IP address, the Unix time and a partial hash value, encrypted with a
>> private Serpent-256 key.
>>> Dave Horsfall <[EMAIL PROTECTED]> 13/05/2004 03:50:14 >>>
> Yep, and that way you can see who sold it to whom.
Absolutely. For instance, the last mail to appear in the box had a recipient address
decoding to:
IP that picked up the address: 216.185.57.146
Picked up at: Sun Nov 30 03:53:42 2003 UTC
Picked up on the 22385th hit to the site (since email addresses were generated this
way) from the front page.
And from the spam, we can determine they sold/gave this address to someone who then
spammed, or perhaps they themselves spammed, from 61.3.216.165 at Thu, 13 May 2004
10:34:18 +0100 (BST) using a mail server which for about 3 months hasn't been listed
as an MX for the domain (but still accepts mail all the same), spamming on behalf of
someone offering university certificates ("Call to register and get yours in days - 1
203 286 2403.").
Perhaps one "attack" against such long-lived MX entries in the spammers' databases
would be to walk a couple of MXs across IP space, changing the DNS MX entries as you
go. At least one spambot use a technique such as this:
http://www.securityfocus.com/guest/24043 Not a lot of good when we run out of IP
address space. But maybe by then the spammers' database will have been updated anyway
(hopefully to a now old or soon-to-expire MX!).
Not having access to my full mail archive, I can't let you know whether the
aforementioned address has been hit before. I'll do a trawl through the addresses
compromised so far, but I don't think there will be any revelatory findings. I think
the main thing that would surprise me is if spammers are using the Google cache to
hide from traps like this. There's probably no need: botnets will pin the blame
elsewhere.
Marek
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
