17 ms·
A little trick to spam the spammers (2021)
- EddieDante 4y agoThis pleases me.
- Minor49er 4y agoI basically do this too, though I just put in some random gibberish (or "admin" or "info" or something) before the domain. I figure they probably have some catchall email address, and if not, nothing wasted On the other hand, if you do want a one-time piece of email, but don't want to be subscribed to a mailing list, check out sharklasers.com. It's a free temporary email service that works pretty well
- sodimel 4y agoI usually search "tempmail service" on some search engine and take a random link.
- ficklepickle 4y agoI use mailinator, but their domains are blocked by many services. Fortunately, they don't check if the provided domain resolves to one of the blocked domains... So I created an MX record on a domain I own that points to a mailinator domain. Works like a charm.
- Minor49er 4y agoThis is brilliant
- rolph 4y agoim sure theres a script for that somewhere about.
- ashton314 4y agoChaotic good right there.
- 1nd1ansumm3r 4y agoThe trick works in analog too. Just stuff the pre-paid business reply mail with other junk mail.
- tanseydavid 4y agoAnd by visiting just about any large IT-related convention you can easily collect a hundred or more pre-paid business reply mail cards. At least that's what a friend told me. ;)
- kibibyte 4y agoThat’s a classic. http://bash.org/?127039 http://bash.org/?127039 I do occasionally wonder if it would still work, but most business reply mail type spam has been supplanted by email nowadays.
- danuker 4y agoI spent hours on bash.org when I found it a few years ago. Thank you for reminding me of it!
- daine 4y agoLooks like we brought down bash.org...
- jamiek88 4y agoAh hunter7 … great memories. The first time I found bash.org I was in tears of laughter for hours reading through it. Back when web culture was smart.
- snoopy_telex 4y agoit was hunter2. I know cause if it was actually hunter7, I would only see **** in your post, but I actually saw ***7.
- 4y ago
- ortusdux 4y agoI've been entering in short complaints as email addresses for a while now. My hope is that the right person will see "whythehhellwouldisignupforyournewsletterafter10seconds@nevercoming.back" and get the message.
- legitster 4y agoI run an email marketing database. You might be pleased to know we keep a little "wall of honor" of the best fake emails we've been given.
- srcreigh 4y agoCare to share any?
- legitster 4y agoMost of them are just various conjugations of swearwords or attempted script injections.
- logifail 4y ago> the best fake emails we've been given If I were to do this, the email wouldn't be fake! I have hundreds of email aliases on my (main) domain, and the list keeps on growing.
- ortusdux 4y agoI have a catchall for my domain, so most sites get a unique website@mydomain.com email and a unique password. Not only does is help against password leaks but I also can find out very quickly if someone sells the unique address.
- willcipriano 4y agoI have a 3 character plus tld domain for this purpose. I used to run my own server with Postfix and Dovecot, I was able to deliver mail and it all worked but Microsoft can do the same thing for less money and effort. The best part of running Postfix was I could add domains and addresses to a denylist and it would bounce the email and the senders server would often put a REJECTED message in their inbox. The email equivalent of slamming the door.
- aendruk 4y agoUsually I’ll add +myfeelings on the local part in case their MTA does subaddressing. And making it unique increases the chances of adding a new entry to their list.
- AdmiralAsshat 4y agoGet the site onto the frontpage of HN and hug the spammers to death? I like it.
- divbzero 4y agoThe design of this blog is delightfully readable: no popups, no banners, no FOUC as I wait for a beautiful webfont to load.
- wizofaus 4y agoExcept for the "beautiful webfront" bit, that was my experience too - no popups/banners/ads while waiting patiently for it to finally load the "Connection timed out" page.
- deleted 4y ago[deleted]
- sodimel 4y agoIf you're speaking about l3m.in I removed unused chars from the font I load (using the super tool on fontsquirrel website) in order to make it lighter. I save the banner images in webp format too (with a liiiittle bit of gaussian blur in order to reduce the size even more) :P The real problem here is my internet connection ; my top upload speed seems to be something like 100-200ko/s, which isn't very much when there's a lot of people loading various parts of my self-hosted websites :(
- wizofaus 4y agoThe link is to a txt file! Anyway the archive link someone else posted seems to work fine (I still can't load the original link).
- sodimel 4y agoOh, ok. On this folder (https://misc.l3m.in/txt/ https://misc.l3m.in/txt/) there is a link to my main website (won't post the link here in order to reduce the load) and I thought you were talking about it :P Keep refreshing like anyone (I guess), my server is at 1.5% of load average, you should be able to access this txt file, if my slow connection is allowing you to reach my server :/
- 4y ago
- codetrotter 4y agoI wonder if most sites maintain any of the following addresses or not for externally incoming mail: hostmaster@<domain> postmaster@<domain> webmaster@<domain> dns-admin@<domain> info@<domain> contact@<domain> root@<domain> (And if they do, if anyone is actually reading the mail coming to those addresses.) I used to but I got so much spam and 0 actually legit mails to these addresses on my own domains so I stopped accepting externally incoming mails for those names/aliases.
- bitbang 4y agoI will often provide the email address postmaster@hashbang.com for people insisting they need an email address who have no legitimate reason doing so. (hashbang.com resolves to localhost. Thanks twocows...)
- c0wb0yc0d3r 4y agoAnyone know why I would get some "random" addresses if I run `nslookup hashbang.com`, but if I run `nslookup hashbang.com.` I get localhost?
- mixmastamyk 4y agoWhy would this work?
- dsl 4y agoEvery email to legal@ has to be read by any legitimate site, thanks to GDPR/CCPA. Not that you'll get a response.
- boshomi 4y agohttps://archive.ph/PyCa9 https://archive.ph/PyCa9
- sodimel 4y agoThanks, my tiny web server still got plenty of power but my connection is pretty terrible today :/
- legitster 4y agoI run marketing email databases. This is cute, but it doesn't actually do anything in most systems - either the employees all already get the marketing emails or there is a system-wide rule to suppress against the email domain. If you actually want to (potentially) break something, try submitting some obscure characters or malformed html into some fields. Blank spaces in emails can particularly be a nuisance. And if you want some real fun, some systems only enforce validation rules via client-side javascript. If you block them, you might be able to submit some real chaotic entries.
- lesuorac 4y agoI've wondered if thats why I can't always sign up for a webpage using their domain before the @ (ex. ycombinator@personaldomain.com). In that somebody else already signed up using webmaster@ycombinator.com and so in response they reject any emails containing "ycombinator".
- mwint 4y agoThis seems like a weird and computationally expensive validation to perform, but it does explain your observation.
- DonHopkins 4y agohttps://news.ycombinator.com/item?id=12951917 https://news.ycombinator.com/item?id=12951917 DonHopkins on Nov 14, 2016 | parent | context | favorite | on: The NHS's 1.2M employees are trapped in a 'reply-a... Back in the days of ARPANET mailing lists, there used to be an "educational" mailing list called "please-remove-me", that was for people who asked an entire mailing list to remove them, instead of removing themselves, or sending email to the administrative "-request" address. So when somebody asked an entire mailing list to remove them, somebody else would add them to the "please-remove-me" mailing list, and they would start getting hundreds of "please remove me" requests from other people, so they could discuss the topic of being removed from mailing lists with people with similar interests, without bothering people on mailing lists whose topics weren't about being removed from mailing lists. It worked so well that it was a victim of its own success: Eventually the "please-remove-me" mailing list was so popular that it got too big and had to be shut down... ...Then there was Jordan Hubbard's infamous "rwall incident" in 1987: http://everything2.com/title/Jordan+K.+Hubbard http://everything2.com/title/Jordan+K.+Hubbard
- banana_giraffe 4y agoReminds me of Bedlam DL3 at Microsoft: https://techcommunity.microsoft.com/t5/exchange-team-blog/me-too/ba-p/610643 https://techcommunity.microsoft.com/t5/exchange-team-blog/me...
- mcnesium 4y ago> discuss the topic of being removed from mailing lists with people with similar interests lol
- temp0826 4y agoSomething similar happened (multiple times?) when I worked at AWS when someone decided to send a mass email to literally the entire company and people inevitably reply-all enough to clog the system and bring it to its knees. Many confused people were replying "UNSUBSCRIBE" (again, to the whole company) as if it would take them off
- avereveard 4y ago
- jedberg 4y agoSince the site is down, what's the trick?
- legitster 4y agoThe entirety of the post: > published: 26/07/21 (dd/mm/yy) > updated: not yet > A little trick to spam the spammers. > When I find a "get X free" button on a website that then asks for my email address, I like to search for the email of the company behind the website (sometimes it's on the legal page, or the privacy policy page) and I submit their email. I also make sure to check the "sign me up for the newsletter" box, to make sure the spammers get at least one of their messages. > I don't really know why I do this, it seemed funny a few months ago when I started and now I do it out of habit. > I now keep a list of emails from these spam sites, and subscribe them all to the various newsletters I find if I have 5 minutes.
- sodimel 4y agoThe site is not down, but my poor upload connection prevent you all to have access to this glorious txt file, sorry :(
- edm0nd 4y agoyour website is down homie. "What kind of chip you got in there, a Dorito?"
- munk-a 4y agoAs a bonus - write yourself a little browser script that accumulates companies you do this to so that you can sign every spammer up for every other spammer's mail.
- treeman79 4y agoI moved out of California many years ago and their fast pass system get calling me daily to inform me my balance was low. I couldn’t get them to stop calling me or cancel the account. So I changed my phone number to their support line number. Never got another call. 15 years later I wonder if they still call themselves.
- dredmorbius 4y agoThe terms ceo@ / sales@ / marketing@ / info@ <domain> can be fun. Or state-level intelligence addresses / TLAs of various stripes.
- dawnerd 4y agoI also like using support@, surprising number use that to create tickets which can annoy someone very quickly.
- toddm 4y agoReminds me of one of my favorite meeting abstracts from David Mazieres and Eddie Kohler at Stanford: https://www.scs.stanford.edu/~dm/home/papers/remove.pdf https://www.scs.stanford.edu/~dm/home/papers/remove.pdf
- the_biot 4y agoWhen I get spam from a local-ish company I always send an abuse mail to their ISP or email provider. Sometimes it's ignored and I keep getting spam from that particular bunch of shitheads. So I set up my .forward to bounce spam from that company right back to any email addresses I can find for them and their ISP. Every spam I get, I add another copy to the list. The folks at xertog.com currently get 8 copies each to their noc@, sales@ etc for every spam they send me.
- grnmamba 4y agoI just put in random gibberish and submit. Too many undeliverable mails can cause the sender be punished by their mailing service.
- bcrosby95 4y agoI used to run a mud back in the late 90s. When we nerfed something a disgruntled player signed up all the admin emails for every piece of spam they could find. It was a huge pain in the butt. Nowadays we would probably barely notice.
- IronWolve 4y agoSpeaking of annoying email lists, spammers are using government state/federal email lists that dont need confirmation. Trolls can just sub people up to hundreds of daily emails. How about spam someone all the train/bus schedules for a city? DOT updates, parks and rec, health updates, DHS, ICE, weather, etc. You cant just remove yourself with replying either, you have to go to a website and remove them, either 1 at a time or if lucky a unsubscribe all. But its ironic the government email lists are being abused to such an extent to annoy people. I had users get caught in such an attack, but easily enough to just spam their domains. Hammer solution, but quick fix.
- avodonosov 4y agoI do a similar thing with web crawlers that do not respect the robots.txt https://github.com/cl-test-grid/cl-test-grid/blob/873b2fa9788f0417d7679c2c778c30011fbadb07/gae-blobstore/server/src/cltestgrid/GetBlob2.java#L30 https://github.com/cl-test-grid/cl-test-grid/blob/873b2fa978... I don't know if this snippet is really effective, can be improved a little, especially that I noticed a couple of new crawlers that ignore `User-agent: * Disallow: /path` in robots.txt, and do not fix that even after reported.
- sodimel 4y agoThat's pretty neat! I should set up something similar for my domains that keep being spammed.
- amiga-workbench 4y agoI wonder if you could abuse gzip compression on responses to send a zip bomb back to them.
- Avamander 4y agoYou can, but most bots do timeout. If you get a lot of bad bots that are vulnerable, then you'll probably waste a lot of resources on those connections.
- winddude 4y agoYes you can. There ar also ways to protect the crawler server from crashing.
- dawnerd 4y agoI did just that for a while with a spare server I had. I set it up to literally only respond to bad bots. I know the crawlers don't care but it amused me at least. I tried to also keep redirecting slowly before it could time out. There was one bot that seemed to create a new instance each redirect so I could keep it in a loop for essentially ever. Just about every other bot only followed a few redirects before giving up. Fun times.
- gigel82 4y ago
- mrtweetyhack 4y ago
- sacrosancty 4y agoI used to get spam from a Chinese exporter who conveniently included their actual address in the emails. One day I happened to be visiting their city and went to their office and asked them to unsubscribe me in person. The lady was very confused and first thought I wanted to buy something. I showed her the spam on my phone and she agreed but didn't bother actually removing me. Just seemed to think I was a bit stupid for travelling so far (I was also a foreigner) to complain about a spam. It was interesting to see what those companies look like in real life though - an office filled with piles of widgets and cartons of deliveries everywhere. These Chinese exporter spammers do tend to be legitimate businesses and they can actually provide good cheap access to manufacturers but they harvest emails from everywhere if there's any hint you might work in a related industry.
- dylan604 4y agoThere's no better motivater than having an upset customer in your presence. I have camped outside the office of someone until a situation was resolved.
- informalo 4y agoDetails please
- dylan604 4y agoIt's really not that interesting of a story. The business manager for the apartment complex I was at was not being prompt on responding. So for 2 days, I sat in the lobby so every time he stepped out of his office, there I was just waiting. I also got to have a little chat with anyone and everyone about why I was there. This included new prospective residents coming to visit the complex as well as existing residents.
- rubatuga 4y agoDo tell
- deleted 4y ago[deleted]
- koliber 4y agoThe concept is called “closing the loop.”
- sam0x17 4y agoI remember in '09 or thereabouts there was a tool called SpamItBack that literally would just send spam all day to known spam addresses while you let it run.
- devonnull 4y agoThis reminds me of a trick a friend used to do: he'd collect the email addresses of spammers who'd targeted and put them into file on his website. Not sure whether that worked or not, but it's fun to imagine that it did.
- sodimel 4y agoSome french blogger did this to people contacting him for putting sponsored content on his website. The text on his contact page literally start with "warning: if you want to pay me to put something on my site your email address will be leaked on this page". Funny how many people won't read any content of a website but still want to pay in order to put content on them :P
- ccn0p 4y agoOK now let's do SMS spam. I get daily reminders from recorded idiots telling me that I qualify for a low-rate business loan! How exciting! I dream of exploring who's actually behind these and wasting their time ala Giovanni Ribisi in Boiler Room. but then I do nothing and go back to what I was doing.
- ttyprintk 4y agoHas anyone tried forwarding those to 7726? https://news.ycombinator.com/item?id=23314816 https://news.ycombinator.com/item?id=23314816
- jethronethro 4y agoWhen I run into something like what the person who posted this describes, I usually put in a non-existent email address. At least, one that I hope is non existent like me@inter.net or homer@compuglobahypermeganet.info.
- skeyo 4y agoThis is why I have a devnull@mydomain.com address that goes directly to trash.
- echan00 4y agoGOD
- aspaviento 4y agoCan we do something like this for spam phone calls? I have a bunch of blocked numbers that could receive a bit of their own medicine.
- d23 4y agoGreat idea. I usually use fake, obscenity-laden email addresses, but I'll start using this approach instead.
- makr17 4y agoIn the 90s I was at a little internet startup, and the product guys _insisted_ that a verification loop for registered emails would be catastrophic and lead to a massive dive in registrations. Engineering pushed back, it went all the way to the CEO, and he sided with product. So we built the damn thing, and it went live, and the CEO got signed up for _everything_ we could think of. Wasn't more than a few days of this before verification suddenly became a good common-sense idea.
- quickthrower2 4y agoFunny. From a "business" point of view the original decision may have been better (but evil). However the CEO made a decision for the business for his personal convenience. I have seen this done before where we were forced to use technology that would support both Mac and Windows because the CTO had a Mac (and that was the only reason). So Silverlight it was :-/. Yes you can guess the year probably!
- dicknuckle 4y agoI can't help but think of Skip the Dishes and how they have zero verification of account emails. I don't use the service and never received any spam, but I did start receiving order confirmations from someone on the other side of the country. Eventually I reset the password and accessed the account to find their phone number and sorted the whole thing out over SMS.
- Tactless001 4y agoThis does nothing to them. You’re better off giving them a real address that you own (can be a garbage secondary account), waiting for them to email you, letting a FEW emails pile up… then marking them ALL as spam in one go. Hurts their sending IPs much more than spamming an inbox they never even check.
- jaimex2 4y agoHeh, you could also do the other usuals all@domain.com allstaff@domain.com support@domain.com legal@domain.com careers@domain.com refunds@domain.com If you really don't like them keep adding those addresses to other subscriptions. If all goes well they'll end up on black lists really quickly.
- motohagiography 4y agoOne wonders if we could use GPT-3 as a spam response bot, where it can start taking up their time sorting through almost plausible auto responses.
- boplicity 4y agoI don't get it -- he's finding optin newsletter boxes and spamming the people asking for an email address? Why? Because he doesn't like optin email?
- ttyprintk 4y agoGuessing it’s the automated pop-ups timed to arrive before you’ve seen whether the site is high quality-enough to deserve it.
- ECG 4y agoBrilliant
- quickthrower2 4y agoAn opt in box asking for your email is not a spammer. It is solicited email.
- tjbiddle 4y agoWhy is "Get X Free" on someone's website bad? If you don't want it, then exit. Just because they have an offer available for those who subscribe doesn't immediately mean they're going to be a bad user of your email.
- denton-scratch 4y agoThis guy has a different idea of what spam is than I do. If you examine a website looking for "sign-me-up" buttons, and click them, and submit a subscription form, then you've solicited their newsletter. Whether you define spam as "Unsolicited Commercial Email" or "Unsolicited Bulk Email", it ain't spam if you asked for it.
- lucideer 4y agoI guess the prevalence of dark patterns in today's websites has blurred the lines here so completely that even the "technically solicited" are grouped in with unsolicited mail if the means by which they were solicited are sufficiently manipulative, annoying, deceiving or briberous.
- denton-scratch 4y ago"Briberous"? As in, "You can't have this service unless we can add your email address to our newsletter"? There is no dark pattern that will persuade me that typing in my email address isn't going to result in commercial email. If doing that is a condition for receiving service, then I have to decide how much I want the service. If I go ahead and sign up, I certainly can't complain that the resulting newsletter is spam. Online shops often require an email address when I order. They send it an order confirmation/invoice or whatever. Is that manipulation or briberousness? This phrase "technically solicited": I suppose if some company gets my email so they can send me an invoice, and then proceeds to send me newsletters daily, with no means to unsubscribe, well, I solicited the order-confirmation, not the newsletters. That's not technically solicited; it's unsolicited (and it's a shop I won't be using again).
- lucideer 4y agoIf that's ok with you, that's cool, but I think many will differ. I live in Europe where we have a few minor rights and such so I guess I just have higher standards for online interactions ¯\_(ツ)_/¯
- sodimel 4y ago
- throwawayt213 4y agoFor marketing spam where unscruplous marketers send spam using bought address lists, you will usually find a subscription form for their lists. Sign up every single spam trap you find. Their ESP will make short work of the marketers after that.
- kebman 4y agoAnyone remember this? A drawing of a seven-legged spider mailed as payment for overdue utility bills. https://27bslash6.com/overdue.html https://27bslash6.com/overdue.html
- koonsolo 4y agoReminds me of a colleague who used to input "president@whitehouse.gov" into all of such mandatory fields (early 2000's). When I asked why, his response was: "If anyone is able to do something about all that spam, it's probably him". :D
- a_c 4y agoNow every website has this obnoxious subscribe now pop-up before showing anything useful. Imagine someone compiled a list of website that shows this pop up, and some email associated with the domain, would the web be a better place?
- sodimel 4y agoIt may. It wouldn't hurt though.
- neop1x 4y agoTheir main contact e-mail can already be unsubscribed but you can try extra emails (after +) like user+spam@company.com Those often arrive to user's inbox but behave like a different address in their spam database. And of course, as others suggested, you can also subscribe sales, hiring, website staff, abuse@ and other departments.