Idiots

Noli arrogantium iniurias pati
(Don't let the bastards grind you down)

Well, I've just looked at the log for the honeypot and found that somebody has been downloading literally thousands of email addresses - no doubt that they think that they will be able to make a whole load money out of their efforts. Maybe they can. Maybe people are stupid enough to buy thousands (or millions) of email addresses and pay good money. Good luck to them because one thing is for certain - the ones that they downloaded from my honeypot won't work.

Whether they are using bot networks of compromised Windows machines (is it still legal to point a Windows machine at the Internet?) or just one, some idiot will be trying to spam us all with his unwanted rubbish.

There are some interesting things about this particular download session:

• it all came from one IP address (205.209.134.60);
• it was done in a few blocks of time, notably:
  • 08/May/2005:04:46:20 +0100 to 08/May/2005:07:47:08 +0100 (177,000 addresses);
  • 08/May/2005:10:49:55 +0100 to 08/May/2005:11:04:31 +0100 ( 11,000 addresses); and then,
  • one page on its own at 09/May/2005:06:41:42 +0100 (1,000 addresses).
• this one IP address downloaded all of these pages. Now, those of you with proper firewalls will know that you can have several borwsers appearing to come from one IP address but if that was the case, the distribution of times between downloads would be different - this was fairly even, suggesting that it was a single machine running a script;
• inspection of a grepped extract of the server log showed that the html files with the email addresses in them were downloaded out of the order that they were in on the honeypot's home page and that there was not a single code 304 - again, if it was a human on a browser and clicking on links at random, you would expect there to be some repeated requests for a download. Even if there were many browsers and no gateway caching (thus no explicit 304s), somebody would have downloaded the same page as someone else (downloading was almost 95 per cent of the site) but there were no duplicate downloads - each page was only downloaded once.
• the agent identity was different for virtually every download. If this was real, there would be an unholy range of browsers for any admin to maintain. Now, I suspect that the person behind this thought to him/herself that if they used only one agent identity, it would cause a spike that would draw attention to the incident whereas, different browsers would not.

It is interesting the amount of trouble they will go to in order to hide their tracks.