Setting Up a Spam Honeypot

Posted Nov 8, 2005 @ 23:08 EDT

The concept is simple - make a mailbox that adds the sender's host IP of any mail received to a blacklist, then refuse mail from those hosts in the future. You entice spammers to send to the mailbox by posting the address in a prominent place. I use this with exim4, and here's how:

1. In system.filter, add this:

   if $recipients contains "blacklist-me@domain.example" then pipe "/usr/local/bin/blacklist-me $sender_host_address" endif

   Make sure you have system_filter_pipe_transport, system_filter_user and system_filter_group defined in your exim config.

2. Now create /usr/local/bin/blacklist-me:

   #!/bin/sh BLACKLIST=/etc/exim/local_host_blacklist echo $* >> $BLACKLIST

   Make it executable.

3. Touch the file /etc/exim/local_host_blacklist, making sure it is writable by system_filter_user. Obviously you should adjust all these paths to suit your own config.

4. Now just make the mailbox valid by putting this in /etc/aliases:

   blacklist-me: /dev/null

That's it! Now anyone who mails blacklist-me@domain.example (put your own domain, of course) will have their IP blacklisted from ever sending you mail again. Easy, isn't it?

2008-04-22 Update: If you run Debian Linux, there are some excellent instructions on running your own MTA with Exim, including a variation on this honeypot, at Spencer Stirling's site. (The honeypot instructions are right at the bottom.)