Honeyd can be used effectively to battle spam. Since June 2003,
Honeyd has been deployed to instrument several networks with
spam traps. We observe how spammers detect open mail relays and
so forth. The diagram on the right shows the overall
architecture of the system. The networks are instrumented with
open relays and open proxies. We intercept all spam email and
analyze why we received it. A single Honeyd machine is capable
of simultaneously instrumenting several C-class networks. It
simulates machines running mail servers, proxies and web
servers. Captured email is sent to a collaborative spam filter
that allows other users to avoid reading known spam. Curiously,
this setup has also been very successful in identifying hosts
infected with worms. Our findings are going to be made available
as research paper in the near future. For questions, please
contact Niels Provos. Honeyd Spam Research Overview Operating
System Distribution and Spam Frequency An interesting question
for understanding how spammers operat