Mail address harvesting

I enabled that non-existent e-mail address to see what would happen. So far I’ve gotten quite a few from non-humans:

1 phishing (PayPal)
2 spam
6 who are you messages

The “who are you” messages are the most interesting. All of them have an embedded image in the message, going to various ports on 220.163.176.206. They’re coming from various IP addresses. Most of them from Asia - China, Taiwan.

Syntax (minus the brackets):

IMG SRC=”http://220.163.176.206:7382/AD.png?eid=my@e-mailaddress&pid=banban” HEIGHT=”0″ WEIGHT=”0″ BORDER=”0″

There are lots of mentions on NANAS of these, but no editorializing. So far I’ve only seen one blog post about the phenomenon.

I’m guessing it’s a way to figure out if an e-mail address is live, and if so, will it get read. I’ve got that address sent to somewhere that blocks web bugs, so hopefully I’m good. But even if not, it’s the server that’s going to have the problem. That address will get failed again after this spam campaign (hopefully) is over.

3 Responses to “Mail address harvesting”

  1. James E. Lang Says:

    This is a good reason to use a mail client that does not by default fetch images that are external to the message. I use Pegasus Mail for this reason among others.

  2. Administrator Says:

    Pegasus mail is absolutely wonderful. I’ve never had a virus! It’s not perfect, but security wise, it’s wonderful.

  3. ()z Says:

    This method of verifying emails has been around for many years.

    Gmail is another client that protects against these kinds of images.

Leave a Reply