Poisoning Spamtraps

Today’s question comes from Dave in yesterday’s comment section.

I wonder if spammers might submit harvested addresses to big-name companies known to not use confirmed opt-in just to poison what they believe might be spamtraps?

It’s certainly possible that people submit addresses to forms and big-name companies. But I don’t really think that poisons the spamtrap.
Depending on who is running the trap a couple of things can happen.

  1. The big company is added to a blocklist. I have dealt with SBL listings of multiple Fortune 50 companies and a host of other national and international brands. Major brands do get blocked and blocklisted repeatedly for sending to trap addresses. And in many cases they’ve had to implement confirmed opt-in to get delisted. In a couple cases, the solution involved corporate wide changes in database and email address handling.
  2. The trap is part of a scoring system and the other mail from that same sender doesn’t result in blocking. For instance, Yelp has been spamming the address of mine harvested off the blog. Other people have mentioned they’re getting Yelp mail to trap addresses. But the vast majority of Yelp’s mail is legitimate and the recipients want it. At most places they won’t be blocked for mailing to that address.

In all cases, it is the responsibility of the sender to verify they have permission to mail an address. If they fail to do that, and end up adding a spamtrap (or other address that doesn’t belong to the submitter) to their mailing list, they are not sending permission email. For many trap maintainers this is enough evidence to drive an entry on a blocklist. For scoring systems, it’s more about the overall mail stream than one or two trap hits.
I’d say that the only thing that can really poison a trap is revealing it or publicly admitting a particular address is a trap. Even in those cases I’m not really sure that’s true, though. My own experience suggests that many spammers, particularly the affiliate types, are too incompetent to suppress trap addresses. In a couple of instances, I’ve been working with clients who have delivery problems related to their use of affiliates. Often I will dig into my own spam corpus for examples of spam pointing to my company. I do turn over trap addresses to the spammers. They still send those addresses spam.
===
Have a question you want answered? Tweet them to wise_ laura or send them to laura-questions@wordtothewise.com.
 
 
 

Harvesting and forging email addresses
It's Thursday: AOL must be having problems

Related Posts

Thanks for your questions!

Thanks, everyone, who submitted questions to laura-questions@wordtothewise.com. We’ve gotten some great questions to answer here on the blog. I’m working through the emails and contacting folks if I have questions. I’ll be answering the first question on Wednesday.
I also did have someone harvest the address off the website and send me non-CAN SPAM compliant spam to it. I have to admit, I didn’t expect someone to harvest the address at all, but especially not within 12 hours of posting an address. Particularly someone who’s not harvested our contact address previously. I also am considering how much content I could get detailing taking the spammer to court in CA for violating CAN SPAM and the CA anti-spam statute.
 

Read More

Information sharing and the Internet

Many years ago I was working at the UW-Madison. Madison is a great town, I loved it a lot. One of the good bits was this local satire paper called The Onion. This paper would show up around campus on Wednesdays. Our lab, like many university employees and students, looked forward to Wednesday and the new humor The Onion would bring to us.
At the same time, I was internet friends with an employee of JPL. I’d met him, like I met many of my online acquaintances, through a pet related mailing list.
One Wednesday, The Onion published an article Mir Scientists Study Effects of Weightlessness on Mortal Terror. As this was the time when the Internet consisted of people banging rocks together, there was not an online link to Onion articles. But I was sure my friend at JPL, and all his friends, would appreciate the joke. That night I stayed late at the lab and typed the article into an email (with full credit to the Onion) and mailed it off to him.
As expected, the article garnered quite a few chuckles and was passed around to various folks inside JPL. What wasn’t expected was another friend, from totally different circles, sending me a copy of that same article 3 days later. Yes, in 1997 it took three days for information to be shared full circle on the Internet.
Information sharing is a whole lot quicker now, with things coming full circle in mere seconds. But that doesn’t make the information any more reliable and true. Take a recent article in ZDNet Research: Spammers actively harvesting emails from Twitter in real-time.
ZDNet links to a study published by Websense, claiming that email addresses on Twitter were available for harvesting.
That’s all well and good, but all ZDNet and Websense are saying is that email addresses are available for harvesting. I’ve not seen any evidence, yet, that spammers are harvesting and sending to them. This doesn’t, of course, mean they’re not, but it would be nice to see the spam email received at an address only shared on twitter.
Well, I have unique addresses and an un-spamfiltered domain. I went ahead and seeded a tagged address onto twitter. We’ll see if it gets harvested and spammers start sending to it. I’ll be sure to keep you updated.

Read More

Handling replies to bulk mail

This week’s Wednesday question comes from Ryan W.

I’ve been noticing a few e-mail accounts who reply to our e-mail sends with spammy type replies such as, “hey this is intense…..(link)” what do you think should we be removing those e-mails from our mailing?

Read More