A spammer’s dozen

As noted in my last post about email spidering, I changed the email contact for Impossibly Stupid to be a simple mailto: link. Here it is just over 12 days later, and I'm spammed already! Quite a bit sooner than the corporate email. Let's examine the data, starting with the important email headers:

Received: from mail.kz (frontend03n.mail.kz [92.46.53.18])
	by homiemail-mx7.g.dreamhost.com (Postfix) with ESMTP id 18F6CCF3EF
	for <info@waitingwatching.impossiblystupid.com>; Sat, 13 Feb 2010 04:54:54 -0800 (PST)
Received: from [213.154.94.76] (account mrszenila3@mail.kz)
  by backend01n.mail.kz (CommuniGate Pro WEBUSER 5.2.13)
  with HTTP id 2954844; Sat, 13 Feb 2010 18:54:56 +0600
From: "mrszenila" <mrszenila3@mail.kz>
Subject: I NEED YOUR  ASSISTANCE TO INVEST IN YOUR COUNTRY

Reading backwards, we have this mrszenila user account that is associated with an IP 213.154.94.76 which is, surprise, located in Africa (the Dakar, Senegal area). The actual mail server IP 92.46.53.18 looks to be out of Almaty, Kazakhstan, using what is likely a free email provider.

That's all good and fine, but it doesn't directly shine any light on how they got our email. A simple mailto: doesn't log anything on the server, so we have to dig at the logs a bit to find anything relevant to the above:


213.154.94.195 - - [12/Feb/2010:21:32:16 -0800] "GET / HTTP/1.1" 200 38080 "-" "Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt; DTS Agent"


That's it. That's the only hit from the entire 213.154.0.0/16 since I made my previous post. No site referral, no images were loaded, no links were followed, no indication of any kind points to a human actually looking at the page. Just the index grabbed, and then the spam a few hours later.

The conclusion is that spammers are still spidering for email addresses, just not very deeply. At least this site, anyway, which is already an oddly large target for comment spammers. The results might be different if I had chosen to run this experiment on the index page of the corporate site. I may still do that, but I don't suggest you do unless you use some of the same techniques I do (e.g., disposable addresses).