Ok let me start with a disclaimer by saying there is a good chance I don't understand how SP is suppose to handle honeypots but lets see if any of this makes sense to you guys.

First of all what is the current method for setting up a honeypot ? I read through all of the post and do you or do you not have to add your honeypot addresses to your AuthorizedTo: list or not ??

Second why do you need to add emails to a list for a honeypot ? Doesn't it make more sense to automatically have a blacklist (or honeypot addresses) built dynamically from emails to addresses that are not in the AuthorizedTo list ?

It seems to me this works backwards because every email I found in my log where addresses were not valid were spam. Wouldn't it make more sense to have a list of emails that should Not be added to a honeypot ?

For example if you have an employee or user who leaves then their email is no longer valid but you may not want to flag the sender as a spammer. So you would keep that address in your AuthorizedTo list for a period of time. But if the name is not in the list then the sender should assume it is spam.

It seems that when I add names to the honeypot I have to guess or go through the log and use the names a spammer is making up. Why not have Spamfilter do that automatically ??

Does any of this makes sense ?

Lee

Marco you bring up some very good points and I appreciate clarification about having to add the emails to authorized user list. I don't think that little tidbid is in the docs. :)

As far as honeypots and fake addresses.  I find mispelled email addresses much less often than spammers guessing names. In fact I am not sure I have seen a mispelled email in my quarrantine.

But I can sit and watch the activity window and see hundreds of fake addresses being used. Which is my point, the is a much more common technique of sending spam. In fact I will have to look at the stats but I would say that the most effective filters I have is the MAPS lookups, blocked Country and AuthorizedTo filters. I do not believe Spamfilter tracks rejected authorizedto but watching the activity log is enlighting.

To me a honeypot with specific addresses would only be useful if you embedded fake addresses in your web site. By making them the same color as the background and putting the mailto might work. Anyone who has a web site will have their email harvested.

But trying to guess what address spammers will use is impossible. Right now I have to look at the log then add those to the honeypot. It still seems to me that I should be able to automatically add those incorrect addresses to the honeypot.

Just like your situation yes maybe someone will get blacklisted by mistake but that comes with the fight against spam. If my suggestion was added then you could put the mispelled addresses in the Whitelist and they would not be added to the honeypot. But any made up names would automatically get blacklisted.

The question comes down what percentage of email has fake addresses vs. mispelling. In my case its 99.9% fake and .1 mispelled names.

Thanks again,

Lee