I do not think the limited intelligence of the spambot spiders can be
depended on any more. From what I have seen recently, I am guessing a more
intelligent and broader spider started harvesting emails for spam sometime
in early to mid December.

1) The email addresses on my web site have all been harvested recently.
These email addresses are all "obfuscated" by being split into multi-line
scripts which also use character entities and numerics. As in:
<script language="JavaScript"> <!--
    document.write ('<A HREF="mailto:gallery')
    document.write ('&#64')
    document.write ('holtenwood.bc.ca">gallery')
    document.write ('&#64')
    document.write ('holtenwood.bc.ca</A>')
// -->
</script>

So this idea does not appear to be working.

(Luckily, the spider seems to have also harvested my hidden junk email
addresses which are there for the spiders to see. I am also getting the same
spams at [log in to unmask] This suggest the spider will have also
harvested the email addresses of the system administrators of about ten
different servers known for being spam friendly. Not much, but it at least
makes me a little happier knowing the jerks are also being hit by the same
spam.)

2) The majority of recently harvested email addresses are ".bc.ca". Not just
country codes, but also a province code (bc = British Columbia, ca =
Canada).

3) The email address I use for the HP3000-L list appears to have also been
harvested at about the same time. I am receiving identical spam at that
email address from identical senders. This implies it is being sold as part
of the same bulk email list. Which implies to me it was harvested by the
same spider from a totally different location.

-----Original Message-----
From: [log in to unmask] [mailto:[log in to unmask]]
Sent: Monday, January 14, 2002 12:02 PM
To: [log in to unmask]
Subject: Re: [HP3000-L] OT: Spam on HP3000-l


X-no-Archive:yes
The assumption has been that the various spiders and bots that harvest email
addresses are extremely limited in their intelligence, and that it does not
take much to fool them. This, too, is a topic of discussion in the groups on
new.spamcop.net. So, for instance, as far as anyone has been able to tell,
the obfuscation of SMTPs using HTML character entities, as mentioned on the
Robelle site, seems to defeat address harvesters. Likewise, it seems that
these address harvesters are only looking for SMTPs that end in .com, or
are, at least, ignoring SMTPs with country codes. In a recent discussion of
who had received a certain spam, those whose addresses ended in .uk seemed
unspammed.

Greg Stigers
http://www.cgiusa.com
Share and Enjoy - [log in to unmask]

* To join/leave the list, search archives, change list settings, *
* etc., please visit http://raven.utc.edu/archives/hp3000-l.html *