Harvesting email addresses

[mightymid]

When those nasty email harvesting types go hunting for email addresses to spam, what exactly are they looking for?

Are they looking for the anchor tag with "mailto:[e-mail]"?

Or are they simply looking for any string of text that might resemble an email address?

(Did that make any sense?)

thanks,
midori

[Yidaki]

Yes, they simply look for any string that looks like a email adress. They even record typos, html messed email adresses etc.

Btw: do you know this trick?:
You can catch the harvesters and match them with the actual spammers pretty easy if you put a generic code on your pages like (using SSI, php or whatever):

<a href="mailto:[e-mail]">dontclick</a>

and then watch all email that goes to this email adress (sure, you have to set up a email account for it - using wildcards Trap*@example.com.) If you receive a message, just look at your logs who hit your pages at the date and the time using the ip that is coded into the spam trap generated email adress and you can match sender with harvester or at least know "the source" of the spammed adress list. ;)

[mightymid]

Hey, that's a pretty cool trick! Thanks!

[mightymid]

Here's a follow-up question...

I've read that one of the ways to obscure an email address is to write it out in numeric code, like so:

&#101;&#120;&#097;&#109;&#112;&#108;&#101;&#064;&#100;&#111;&#109;&#097;&#105;&#110;&#046;&#099;&#111;&#109;

(that's [e-mail])

Are there bots out there, though, that are capable of "decoding" this?

[Dreamquick]

Are there bots out there, though, that are capable of "decoding" this?

Yes, I'd wager there are plenty - I saw one a while ago while testing an anti-harvesting script of my own, and that's just off-the-shelf stuff... I imagine they get a lot more advanced if you actually knew where to look / who to ask.

That said there aren't that many - decoding adds complexity and slows through-put, and lots of the "bargain basement" products pride themselves on their throughput, also another reason for not including this in low-end products is that sending to munged addresses will probably result in a lot more complaints that normal.

Does it work? Yes most of the time. It using it a good idea? No not really, if you want to be spam-free that badly then use a response form or something similar - munging relies on security through obscurity which is never a good thing.

- Tony

[g1smd]

Use javascript in an external file to document.write the email link, from fragments that the JS then reconstructs, or use an email form on the page.

See the similar thread to this one, from a couple of months back, for more ideas.