Harvesting and forging email addresses

For the contact address on our website, Steve has set up a rotating set of addresses. This is to minimize the amount of spam we have to deal with coming from address harvesters. This has worked quite well. In fact it works so well I didn’t expect that publishing an email address for taking reader questions would generate a lot of spam.

Boy, was I wrong. That address has been on the website less than a month and I’m already getting lots of spam to it. Most of it is business related spam, but there’s a couple things that make me think that someone has been signing that address up to mailing lists.

One is the confirmation email I received from Yelp. I don’t actually believe Yelp harvested my address and tried to create me an email account. I was happy when I got the first mail from Yelp. It said “click here to confirm your account.” Yay! Yelp is actually using confirmations so I just have to ignore the mail and that will all go away.

At least I was happy about it, until I started getting Yelp newsletters to that address.

Yelp gets half a star for attempting to do COI, but loses half for sending newsletters to people who didn’t confirm their account.

I really didn’t believe that people would grab a clearly tagged address off the blog and subscribe it to mailing lists or networking sites. I simply didn’t believe this happened anymore. I know forge subscribing used to be common, but it does appear that someone forge signed me up for a Yelp account. Clearly there are more dumb idiots out there than I thought.

Of course, it’s not just malicious people signing the address up to lists. There are also spammers harvesting directly off the website.

I did expect that there would be some harvesting going on and that I would get spam to the address. I am very surprised at the volume and type of spam, though. I’m getting a lot of chinese language spam, a lot of “join our business organization” spam and mail claiming I subscribed to receive their offers.

Surprisingly, much of the spam to this address violates CAN SPAM in some way shape or form. And I can prove harvesting, which would net treble damages if I had the time or inclination to sue.

It’s been an interesting experience, putting an unfiltered address on the website. Unfortunately, I am at risk of losing your questions because of the amount of spam coming in. I don’t think I’ve missed any, yet, but losing real mail is always a risk when an address gets a lot of spam – whether or not the recipient runs filters.

I’m still pondering solutions, but for now the questions address will remain as it is.


  1. Matt - @emailkarma says

    Have you thought about a Questions comment form – you could save some of the harvesting/spam issues and still get the questions…

    1. laura says

      Comment forms have their own issues, but it’s one solution.

  2. The Dave says

    I wonder if spammers might submit harvested addresses to big-name companies known to not use confirmed opt-in just to poison what they believe might be spamtraps?

  3. John L says

    A fairly effective trick in a situation like this is to tell people to put a magic word in the subject line. It’s not workable in general, but in this case the real questions will come from people who saw the address and promptly wrote to you, and should have seen the magic word at the same time.

    1. laura says

      I’m not sure I’m competent enough with sieve filtering to be able to write that filter. I’m pretty sure it’s possible, though. That’s a good thought.

  4. Poisoning Spamtraps – Word to the Wise says

    […] question comes from Dave in yesterday’s comment section. I wonder if spammers might submit harvested addresses to […]


Your email address will not be published. Required fields are marked *

  • DNS problems

    Hurricane Electric had a significant outage of their authoritative DNS servers this morning, causing them to return valid responses with no results for all(?) queries. This will have caused delivery problems for any mail going to domains using DNS - which will include some of their colocation customers, as well as users of their free services - but also will have caused reverse DNS to fail for most servers hosted by Hurricane Electric worldwide, so if any of your mail is being sent from HE hosted machines you may have seen problems. (We're HE customers so we noticed. Still happy with them as a vendor.)No Comments

  • DNS issues

    If you're sending email from any address beginning with a 65 - in - it's possible you'll see some delivery problems. Something appears to be broken with dnssec signatures for the reverse DNS zone, leading queries for reverse DNS to fail for anyone using a dnssec aware DNS resolver (which is almost everyone).1 Comment

  • Our green bar certificate is going away

    Later today we'll be switching from an Extended Validation ("green bar") SSL certificate to a Domain Validation certificate. This isn't exactly a planned change but I'm waiting for responses from Comodo before I go into it too much. I'll share some more details next week.3 Comments