Poisoning Spamtraps

Today’s question comes from Dave in yesterday’s comment section.

I wonder if spammers might submit harvested addresses to big-name companies known to not use confirmed opt-in just to poison what they believe might be spamtraps?

It’s certainly possible that people submit addresses to forms and big-name companies. But I don’t really think that poisons the spamtrap.
Depending on who is running the trap a couple of things can happen.

  1. The big company is added to a blocklist. I have dealt with SBL listings of multiple Fortune 50 companies and a host of other national and international brands. Major brands do get blocked and blocklisted repeatedly for sending to trap addresses. And in many cases they’ve had to implement confirmed opt-in to get delisted. In a couple cases, the solution involved corporate wide changes in database and email address handling.
  2. The trap is part of a scoring system and the other mail from that same sender doesn’t result in blocking. For instance, Yelp has been spamming the address of mine harvested off the blog. Other people have mentioned they’re getting Yelp mail to trap addresses. But the vast majority of Yelp’s mail is legitimate and the recipients want it. At most places they won’t be blocked for mailing to that address.

In all cases, it is the responsibility of the sender to verify they have permission to mail an address. If they fail to do that, and end up adding a spamtrap (or other address that doesn’t belong to the submitter) to their mailing list, they are not sending permission email. For many trap maintainers this is enough evidence to drive an entry on a blocklist. For scoring systems, it’s more about the overall mail stream than one or two trap hits.
I’d say that the only thing that can really poison a trap is revealing it or publicly admitting a particular address is a trap. Even in those cases I’m not really sure that’s true, though. My own experience suggests that many spammers, particularly the affiliate types, are too incompetent to suppress trap addresses. In a couple of instances, I’ve been working with clients who have delivery problems related to their use of affiliates. Often I will dig into my own spam corpus for examples of spam pointing to my company. I do turn over trap addresses to the spammers. They still send those addresses spam.
===
Have a question you want answered? Tweet them to wise_ laura or send them to laura-questions@wordtothewise.com.
 
 
 

Related Posts

Equivocating about spamtraps

What is a spamtrap? According to a post I saw on Twitter:

Read More

Information sharing and the Internet

Many years ago I was working at the UW-Madison. Madison is a great town, I loved it a lot. One of the good bits was this local satire paper called The Onion. This paper would show up around campus on Wednesdays. Our lab, like many university employees and students, looked forward to Wednesday and the new humor The Onion would bring to us.
At the same time, I was internet friends with an employee of JPL. I’d met him, like I met many of my online acquaintances, through a pet related mailing list.
One Wednesday, The Onion published an article Mir Scientists Study Effects of Weightlessness on Mortal Terror. As this was the time when the Internet consisted of people banging rocks together, there was not an online link to Onion articles. But I was sure my friend at JPL, and all his friends, would appreciate the joke. That night I stayed late at the lab and typed the article into an email (with full credit to the Onion) and mailed it off to him.
As expected, the article garnered quite a few chuckles and was passed around to various folks inside JPL. What wasn’t expected was another friend, from totally different circles, sending me a copy of that same article 3 days later. Yes, in 1997 it took three days for information to be shared full circle on the Internet.
Information sharing is a whole lot quicker now, with things coming full circle in mere seconds. But that doesn’t make the information any more reliable and true. Take a recent article in ZDNet Research: Spammers actively harvesting emails from Twitter in real-time.
ZDNet links to a study published by Websense, claiming that email addresses on Twitter were available for harvesting.
That’s all well and good, but all ZDNet and Websense are saying is that email addresses are available for harvesting. I’ve not seen any evidence, yet, that spammers are harvesting and sending to them. This doesn’t, of course, mean they’re not, but it would be nice to see the spam email received at an address only shared on twitter.
Well, I have unique addresses and an un-spamfiltered domain. I went ahead and seeded a tagged address onto twitter. We’ll see if it gets harvested and spammers start sending to it. I’ll be sure to keep you updated.

Read More

Is Amazon SES a reputable place to send mail from

On the first installment of our Wednesday question series, I chose a question from twitter.

Read More