One of the things Imagiware provides for web hosting customers is access to mailing list software, such as Mailman or Majordomo. We encourage the customers to use an “open+confirm” subscription policy for public lists, which means that every subscription has to be confirmed by the person being subscribed. Confirmation is usually facilitated through an e-mail sent to the address being subscribed. This seems like a perfectly reasonable policy, but some customers have been reluctant to do this for fear of cutting their subscriber base growth rate. The validity of that fear shall be discussed another time.
For those customers who keep an “open” subscription policy (ie: one without the confirmation step), a new problem has cropped up. In the war on spam, some folks have decided to start adding “spamtrap” email addresses to open lists as a means of shutting down list delivery. Here is the word from a SpamCop Admin:
> A spamtrap is an unused address whose sole reason for existence is to see
> if people will send unsolicited mail to it. Trap addresses are almost
> exclusively the nonexistent addresses at small vanity domains owned by us
> or our pals. Basically, *all* mail to those domains is fed directly to our
> spam processing system. The addresses are not monitored, do not send mail,
> and are not used by anyone for any purpose. Some have been hidden in the
> code on web pages as bait for harvesting robots.
So far, SpamCop has been very responsive in removing our servers from their blackhole lists. However, the time that it takes to address these issues is increasing. It is unclear *who* is adding these spamtraps to the lists. While it is plausible that the spamtrap owners themselves are doing the subscriptions, as a way of forcing people to adopt/require an “open+confirm” policy, I see wider possibilities.
One possibility is that this is a new “dirty trick” on the competitive landscape. Finding a spamtrap address is trivial, so shutting down an open list is a quick and free way to cut somebody’s audience size and cause headaches for their system administrators.
A variant on that trick might be used by spammers who wish to create friction between legitimate list owners and people who are trying to stem the flow of unsolicited garbage. By subscribing spamtrap addresses, the spammer invests a miniscule amount of time, while system admins and spamfighters must spend a non-trivial amount of time fixing the problem. The force-multiplication nature of this technique makes it cheap and highly effective. Not good.
We’re moving towards a requirement that all lists must use “open+confirm”. We’ve held back to accomodate a number of large customers, but we’re fasting approaching a point where it won’t be worth the hassle to allow open lists.