E-Mail Harvesting

[SamMan]

May be a bit off-topic...

When bots scan the web for e-mail address to use for spam, do they look at
what the browser is displaying, or scan through the underlying HTML markup
for e-mail addresses?

At work, we have stopped displaying our webmaster e-mail on our pages and
created a form that uses cgi to process and send the message. Our e-mail
however, is hard coded as a variable in the form and sent to the script.
Will harvesters still be able to get the address, or does it have to be
displayed on the page?

Or do e-mails get harvested in this way at all?

Thanks in advance...
--
SamMan
Rip it to reply

[Brian]

SamMan wrote:

May be a bit off-topic...
It's arguable; but it is discussed here from time to time.
When bots scan the web for e-mail address to use for spam, do they
look at what the browser is displaying, or scan through the
underlying HTML markup for e-mail addresses?
AFAIK, they look for mailto: links and for text that looks like an
email address, i.e., a series of letters and numbers, an @ sign, and
more letters and numbers, with certain punctuation.
At work, we have stopped displaying our webmaster e-mail on our
pages and created a form that uses cgi to process and send the
message.
Best practice is to provide both a form and an email address.
Our e-mail however, is hard coded as a variable in the form and
sent to the script.
Which script are you using? The NMS formmail script allows one to
define an alias in config file outside of the directories accessible
by the web.
Will harvesters still be able to get the address, or does it have
to be displayed on the page?

Yes.

--
Brian
follow the directions in my address to email me

[Spartanicus]

SamMan wrote:

At work, we have stopped displaying our webmaster e-mail on our pages and
created a form that uses cgi to process and send the message. Our e-mail
however, is hard coded as a variable in the form and sent to the script.

Change the script so that it contains the address. If you have to use a
3rd party (ISP) script that you cannot control, then you may be able to
use character references in the form, like @ for "@" and . for
".", I do this and my ISP's script accepts it (using character
references is surprisingly effective against harvesting).

Having said that, I have no proof that email harvesters read form
parameter values, but better safe than sorry imo.

--
Spartanicus

[Beauregard T. Shagnasty]

Spartanicus pounced upon this pigeonhole and pronounced:

SamMan wrote:

At work, we have stopped displaying our webmaster e-mail on our pages and
created a form that uses cgi to process and send the message. Our e-mail
however, is hard coded as a variable in the form and sent to the script.
Change the script so that it contains the address. If you have to use a
3rd party (ISP) script that you cannot control, then you may be able to
use character references in the form, like @ for "@" and . for
".", I do this and my ISP's script accepts it (using character
references is surprisingly effective against harvesting).

Try this page. (some days it is slow to load)
http://alicorna.com/cgi/obfuscator.cgi
Having said that, I have no proof that email harvesters read form
parameter values, but better safe than sorry imo.

Neither have I proof, other than to say that all addresses at my sites
that began life obfuscated in this fashion have never received spam.

--
-bts
-This space intentionally left blank.

[Spartanicus]

Beauregard T. Shagnasty wrote:

(using character
references is surprisingly effective against harvesting).

Try this page. (some days it is slow to load)
http://alicorna.com/cgi/obfuscator.cgi

It only takes 1 character to be converted to a character reference "@"
is @, easy to remember. There's no need to convert the entire
address to character references, that will only serve to make it
unreadable by humans.

--
Spartanicus

[Beauregard T. Shagnasty]

Spartanicus pounced upon this pigeonhole and pronounced:

Beauregard T. Shagnasty wrote:

(using character
references is surprisingly effective against harvesting).

Try this page. (some days it is slow to load)
http://alicorna.com/cgi/obfuscator.cgi

It only takes 1 character to be converted to a character reference "@"
is @, easy to remember. There's no need to convert the entire
address to character references, that will only serve to make it
unreadable by humans.

Heh, humans rarely read the source of the page. <g>

--
-bts
-This space intentionally left blank.

[Spartanicus]

Beauregard T. Shagnasty wrote:

It only takes 1 character to be converted to a character reference "@"
is @, easy to remember. There's no need to convert the entire
address to character references, that will only serve to make it
unreadable by humans.

Heh, humans rarely read the source of the page. <g>

One may hope that the author is also human :)

--
Spartanicus

[Beauregard T. Shagnasty]

Spartanicus pounced upon this pigeonhole and pronounced:

Beauregard T. Shagnasty wrote:

It only takes 1 character to be converted to a character reference "@"
is @, easy to remember. There's no need to convert the entire
address to character references, that will only serve to make it
unreadable by humans.

Heh, humans rarely read the source of the page. <g>

One may hope that the author is also human :)

Well, that certainly is a point. One could only hope then, that if the
author is smart enough to know how the obfuscation works, that is does not
present a problem. <more_smileys >

--
-bts
-This space intentionally left off to football.

[SamMan]

"Spartanicu s" <[e-mail] > wrote in message
news:7t******** *************** *********@news. spartanicus.utv internet.ie...

SamMan wrote:

At work, we have stopped displaying our webmaster e-mail on our pages and
created a form that uses cgi to process and send the message. Our e-mail
however, is hard coded as a variable in the form and sent to the script.

Change the script so that it contains the address. If you have to use a
3rd party (ISP) script that you cannot control, then you may be able to
use character references in the form, like @ for "@" and . for
".", I do this and my ISP's script accepts it (using character
references is surprisingly effective against harvesting).

Having said that, I have no proof that email harvesters read form
parameter values, but better safe than sorry imo.

--
Spartanicus

Thanks for all of the answers & tips.

On my personal site, I have a technique in place, and would like to know if
this is also good for obfuscation.

I have an external JavaScript file that takes each part of the email and
assigns it to a variable (beg, mid, end).
beg = myname;
mid = @;
end = something.com;

In the actual page, the values are written ... document.write( beg + mid +
end)...

Is this a good way to hide emails too?

Thanks again!
--
SamMan
Rip it to reply

[SamMan]

"SamMan" <ps*@psfdevri p-it.com> wrote in message
news:Cf******** ***********@twi ster.rdc-kc.rr.com...

"Spartanicu s" <[e-mail] > wrote in message
news:7t******** *************** *********@news. spartanicus.utv internet.ie...

SamMan wrote:

At work, we have stopped displaying our webmaster e-mail on our pages andcreated a form that uses cgi to process and send the message. Our e-mailhowever, is hard coded as a variable in the form and sent to the

script.
Change the script so that it contains the address. If you have to use a
3rd party (ISP) script that you cannot control, then you may be able to
use character references in the form, like @ for "@" and . for
".", I do this and my ISP's script accepts it (using character
references is surprisingly effective against harvesting).

Having said that, I have no proof that email harvesters read form
parameter values, but better safe than sorry imo.

--
Spartanicus

Thanks for all of the answers & tips.

On my personal site, I have a technique in place, and would like to know

if this is also good for obfuscation.

I have an external JavaScript file that takes each part of the email and
assigns it to a variable (beg, mid, end).
beg = myname;
mid = @;
end = something.com;

In the actual page, the values are written ... document.write( beg + mid +
end)...

Is this a good way to hide emails too?

.... of course, I for got to put quotes around my values... i.e. beg =
"myname";
--
SamMan
Rip it to reply