Honeypots mailing list archives

am-best honeypot?

From: Andy_Bach () wiwb uscourts gov
Date: Thu, 20 Apr 2006 15:20:44 -0500

Hi.

May be a tad OT here, but I found a google link to (searching for 
'lotech.us' a spammers email):
http://www.am-best.com/honeypot/honey011.htm

which turned out to be a few 1000 email addresses.  Backing up to the home 
page, got some weird browser behaviour and the source shows:

<a href="http://www.am-best.com/honeypot/honey.cfm";><img 
src="http://www.am-best.com/images/shim.gif"; width="1" height="1" 
border="0" alt=""></a>
</center>

the "shim.gif" is tiny and the honey.cfm page is:
<html>
<head></head>
<body> 
<A HREF="honey000.htm">honey000.htm</A>
...
<A HREF="honey000.htm">honey039.htm</A>

Is this any sort of usual honeypot behavior?  Are they hacked?

Thanks.

a

Andy Bach, Sys. Mangler
Internet: andy_bach () wiwb uscourts gov 
VOICE: (608) 261-5738  FAX 264-5932

"No matter how cynical you become, it's never enough to keep up." 
?Lily Tomlin

Current thread:

am-best honeypot? Andy_Bach (Apr 20)