OT Web site contact boxes

[John Rumm]

Fraid so. The more popular it becomes (and more linked to), the worse it will get as well.

If you look at the HTML source of a typical web site, an email link looks like (address used "altered to protect the innocent"):

some bit of text

That makes it very easy to find an email address just by downloading the page and searching[1] for "mailto:" followed by a string of characters. If you spam harvesting robot needs a bit more validation, it can also look for the giveaway "@", as well as "." to see if the whole string matches the expected "pattern" of an email address.

If you were to change that to something like:

some bit of text

There is less chance that a search will find the address. It would in theory be possible for the email scraper to unravel the coding easily enough, but it then means that it has to take extra time rendering the HTML for every one of the billions of pages it downloads. There are also loads of different ways of doing the obfuscation (character replacement, javascript etc) which makes a "one size fits all" scraper harder to write. The above link however will look and work just the same in the browser. Obviously it does not protect you from people reading the address and manually adding it to a spam address database, but it seems to slow the progress somewhat.

There is an (now ageing, but still handy) article that covers some of the findings of research on this here:

The search could be a simple text search or a more powerful "Regular Expression" search.

[Colin Wilson]

I'm scared to ask - how large a company is it ?

[djc]

Don't bounce, it just indicates that the domain is valid. Better to silently drop unwanted mail.

[John Laird]

Never really had you down as a confirmed hair-shirt wearer. I didn't think Demon had any customers left...

I use Gmail as web mail suits my work patterns. Their spam filter is top notch. The odd one sneaks through, but I can't recall the last time I saw a real email they'd marked as spam. I get about 200-300 spams per day, probably from posting to Usenet and/or choosing an email address that is too easy to get from a dictionary style attack.

-- "Flirt: A woman who thinks it's every man for herself."

[Gordon Henderson]

I gave up some years ago. I've had the same email address for over 10 years now and hope to have it for the next 10 too. I block upward of

2000 a day, sometimes more. A small number do get through, but every now & then I rework some of the filters and I'm file for a while longer.

Gordon

[Mathew Newton]

An invalid domain doesn't silently drop mail - it fails the MX resolution at the outset. Hence, silently dropping mail doesn't make you look like an invalid domain, indeed quite the opposite - it suggests the mail/address was accepted as valid!

Mathew

[Mathew Newton]

Out of interest, how does that number compare to throughput of 'legitimate' mail?

Mathew

[John Rumm]

Being realistic, there is very little you can do to make a real domain look invalid. (you could run your own DNS and firewall incoming MX record requests from known spam IPs, but that is not going to catch much of it these days).

[Adam Funk]

They're designed for the business's convenience and the customer's inconvenience.

If you want a copy, try the Firefox Scribe extension, which lets you load and save webform contents locally.

With some forms you can use your browser's "view source" option and search for "@", but in most cases, no.

[Huge]

Huge's Law; "All ISPs suck." They may suck in different ways and at different times, but nonetheless they all suck.

You want the NSA to read all your mail? Mind you, I suppose they read it all anyway.

[Huge]

I don't know how much incoming mail there is without checking with the mail administrators, but I happen to have the outgoing figures to hand; we have ~45,000 users who send ~3 million mails a month between them. If we assume that each outgoing email generates a response (probably foolish), that's about 90,000 genuine emails a day. Thats a spam:ham ratio of 133:1.

(I've just got up. If these figures are wrong, don't be *too* hard on me.)

[dmc]

We did a bit of playing a while back and discovered that a fair few spammers appeared to lock onto to our lowest priority MX - presumably on the theory this was less loaded or less closely monitored or something.

Also, despite moving our MXs around a bit we still see *huge* amounts of email coming into the old address (well, attempting to - it doesn't get far :)) suggesting that spammers are using lists of servers collected sometime ago and are not bothering to do more dns lookups.

We are currently running with greylisting which has helped a huge amount and so far we have only had a couple of broken sites that bounce when we issue them a 5xx temporary failure...and they were sooo broken for other reasons we had no desire to allow them to email us :)

Darren - and now back to drills, plastering and combi conversations as this is getting a bit too much like work :)

[Mathew Newton]

What a sad state of affairs eh?

Mathew

[Huge]

Isn't it.

I think something's going to have to change. Just as long as whatever it is isn't mandated by Government.