EMail harvester unmasked

Art-Online.com 0.9(Beta)

[Yidaki]

194.242.43.13 - - [28/Sep/2003:14:23:32 +0100] "GET /index.htm" 200 11789 "-" "Art-Online.com 0.9(Beta)"

The requested pages contain dynamic email adresses used to catch harvester. ([e-mail]). Two hours after the requests the catcher email adresses received about 30 spam messages from art-online.com (30 different time stamps = 30 different email adresses). Art-Online.com is the same as artmarket.com which is allready blocked at our mail server.

Return-Path: [e-mail]
From: A R T <[e-mail]>
Received: from [194.242.43.188]

Sent them a strong complain and blocked them at the router now.

whois info:

inetnum:      194.242.43.0 - 194.242.43.255 
netname:      FR-GROUPE-SERVEUR 
descr:        GROUPE-SERVEUR 
country:      FR 
admin-c:      CV157-RIPE 
tech-c:       CV157-RIPE 
status:       ASSIGNED PI 
remarks:      For any complaint, please mail to "[e-mail]" or 
              "[e-mail]"

<added>
[google.com...]

[BlueSky]

Oh really. He came to my site last week. He didn't do anything odd just requested a couple pages, and I don't have any text email addresses on my site. When I looked him up, I couldn't imagine why an art auction bot was visiting so I banned him thinking he might be an image grabber. Nice to know, he's really an email harvester instead. Thanks for the info.

Almost need a score card for all these bots.

[shasan]

that's clever. I may be able to do something similiar. I am not fond of email harvesters.

Thanks!