Win the SPAM Arms Race

by Dan Benjamin

78 Reader Comments

Back to the Article
  1. If you use cgi to provide web based email through forms, you do not have to display your email address. I do that in my shop and it works.

    If you generate bogus random addresses like bs@bs.com you will tip them off to the sys admin when they begin a mailing getting thousands of “address unknowns”, or wasting their bandwidth if they are a service.

    If you must display an email address, make an image that uses the method Xavier Defrang mentions above to link it, with the function as an external .js script.

    The link is not my site, just a place i found where you can get these simple scripts if you are too lazy to write them.

    Avitar

    Copy & paste the code below to embed this comment.
  2. דגכעדשגכשדגכדגכדגכ

    Copy & paste the code below to embed this comment.
  3. Check out spamgourmet.com
    It works the same as sneakEmail.com

    Copy & paste the code below to embed this comment.
  4. http://www.neilgunton.com/spambot_trap/

    Just search for “Balu” to find my php-solution, that generates a uniq mailto: for each visitor – which looks like

    web-32bitIP.timestamp@example.com

    This way I can easily reject addresses that were found by bots and are used for SPAMming. I even know where the bot came from and when. I can even find them in the webserver-logfiles and analyze their activity.

    There are many other ideas and hints on that page too…

    Balu
    Copy & paste the code below to embed this comment.
  5. Just use a contact form that then mails you the content of the form. The user doesn’t need to know your e-mail address at all.
    I use one at my site and users find it easy to use.
    Cheers

    Copy & paste the code below to embed this comment.
  6. By far the most elegant approach AFAIK;
    Catch the email harvester in a tar pit and destroy it’s database.
    (including the email address just snatched from your HTML)

    All mail links can remain unmodified.

    http://www.monkeys.com/wpoison/

    Copy & paste the code below to embed this comment.
  7. The easiest and as far as I know most fool-proof method is one that Xavier almost alluded to. It involves a simple Javascript function that assembles an email address when the user clicks a hyperlink.

    function mail(user) {
    locationstring = “mailto:” + user + “@” + “domain.com”;
    [removed] = locationstring;
    }

    You can of course add more variables so that you may use multiple domains, ie:

    function mail(user,dom,tld) {
    locationstring = “mailto:” + user + “@” + dom + “.” + tld;
    [removed] = locationstring;
    }

    In the hyperlink, just call the function:

    [removed] mail(‘johndoe’,‘domain’,‘com’);

    This method has proved exceptionally reliable. To test it, I put a page with a normal email link to spam@mydomain.com and one to my real address assembled through this Javascript function. Spam comes to the spam address, but not to my real address.

    Hopefully this helps someone!

    Copy & paste the code below to embed this comment.
  8. In pure HTML you can extra tags that will not get in the way.
    You can also use the character entities.
    JavaScript would be needed to dynamically add this to the HREF of the mailto link.
    You can even distribute the parts of you email address in invisible tags around the page, even put some bits in attributes, and use JavaScript to reconstruct it in.

    Problem with non-javascript browsers though.

    Maybe have <? include my_email.txt ?> in the mailto href and on the page for a server side solution. But don’t bots get to the page after sever-side processing?

    Copy & paste the code below to embed this comment.