BLOG

Poisoning Spamtraps

Today’s question comes from Dave in yesterday’s comment section.

I wonder if spammers might submit harvested addresses to big-name companies known to not use confirmed opt-in just to poison what they believe might be spamtraps?

It’s certainly possible that people submit addresses to forms and big-name companies. But I don’t really think that poisons the spamtrap.

Depending on who is running the trap a couple of things can happen.

  1. The big company is added to a blocklist. I have dealt with SBL listings of multiple Fortune 50 companies and a host of other national and international brands. Major brands do get blocked and blocklisted repeatedly for sending to trap addresses. And in many cases they’ve had to implement confirmed opt-in to get delisted. In a couple cases, the solution involved corporate wide changes in database and email address handling.
  2. The trap is part of a scoring system and the other mail from that same sender doesn’t result in blocking. For instance, Yelp has been spamming the address of mine harvested off the blog. Other people have mentioned they’re getting Yelp mail to trap addresses. But the vast majority of Yelp’s mail is legitimate and the recipients want it. At most places they won’t be blocked for mailing to that address.

In all cases, it is the responsibility of the sender to verify they have permission to mail an address. If they fail to do that, and end up adding a spamtrap (or other address that doesn’t belong to the submitter) to their mailing list, they are not sending permission email. For many trap maintainers this is enough evidence to drive an entry on a blocklist. For scoring systems, it’s more about the overall mail stream than one or two trap hits.

I’d say that the only thing that can really poison a trap is revealing it or publicly admitting a particular address is a trap. Even in those cases I’m not really sure that’s true, though. My own experience suggests that many spammers, particularly the affiliate types, are too incompetent to suppress trap addresses. In a couple of instances, I’ve been working with clients who have delivery problems related to their use of affiliates. Often I will dig into my own spam corpus for examples of spam pointing to my company. I do turn over trap addresses to the spammers. They still send those addresses spam.

===

Have a question you want answered? Tweet them to wise_ laura or send them to laura-questions@wordtothewise.com.

 

 

 

Comment:

Your email address will not be published. Required fields are marked *

  • HE.net DNS problems

    Hurricane Electric had a significant outage of their authoritative DNS servers this morning, causing them to return valid responses with no results for all(?) queries. This will have caused delivery problems for any mail going to domains using HE.net DNS - which will include some of their colocation customers, as well as users of their free services - but also will have caused reverse DNS to fail for most servers hosted by Hurricane Electric worldwide, so if any of your mail is being sent from HE hosted machines you may have seen problems. (We're HE customers so we noticed. Still happy with them as a vendor.)No Comments


  • 65.0.0.0/8 DNS issues

    If you're sending email from any address beginning with a 65 - in 65.0.0.0/8 - it's possible you'll see some delivery problems. Something appears to be broken with dnssec signatures for the reverse DNS zone, leading queries for reverse DNS to fail for anyone using a dnssec aware DNS resolver (which is almost everyone).1 Comment


  • Our green bar certificate is going away

    Later today we'll be switching from an Extended Validation ("green bar") SSL certificate to a Domain Validation certificate. This isn't exactly a planned change but I'm waiting for responses from Comodo before I go into it too much. I'll share some more details next week.3 Comments


Archives