How are You Preventing Mailto-Link Harvesting?

mixwhit asks: "In our ever increasing effort against spam, we are now considering replacing all mailto: links on our website with something unharvestable (i.e. 'user (at) address', javascript mailto links, character entity evasion, etc.). Obviously this won't stop the spam, but it seems prudent to stop the harvesting so that the spam may slow down someday (year 2024 maybe?). What are others doing with this issue? We would prefer to preserve mailto link clickability, but also only want to make this adjustment once." One suggestion I would make is to put your email address in an image. People can read it, but harvesters won't be able to harvest it (unless they download the image for OCR), but any barrier you can place in front of the spammer, without blocking people honestly interested in communicating with you, is probably a good thing.

Mail form

[NaDrew]

Just use a mail form instead of mailto: links. Once you reply to feedback mail, the sender has your address and you can correspond normally. Meanwhile, evil spambots can't harvest an address that isn't shown anywhere.

Re:Mail form

[jpsowin]

I agree with this in concept (if it is implemented correctly), as long as people understand that FormMail is one of the biggest exploits of spammers out there. They just use the form to use your server to send their emails. Don't believe me? Check any server log. ;)

Re:Mail form

[skookum]

That is only the case if you are running an ancient, brain dead copy of the original (Matt's Script Archive) formmail.pl. But you'd be a retard for doing that and deserve everything you get. Modern formmail scripts do not allow spam through.

Re:Mail form

[innosent]

I agree 100%. Either use something like formmail.pl, or write your own custom CGI program to handle emails. It is trivial to write a mail form, and users who wish to contact you will be at your website anyways, so why make them read the address and fire up their mail client? Hell, depending on your site (if you have user registrations), you could even use a database-driven email system, and eliminate spam entirely. Just let the user fill out the form, store the message in the database, and when you repl

Re:Mail form

[scrytch]

> I agree 100%. Either use something like formmail.pl, or write your own custom CGI program to handle emails

Ironic, that in order to stop spam to you, you would use the notoriously buggy and insecure formmail, turning your box into an open mail relay for spammers to use. Use a secure alternative (there's compatible versions, but really it's not hard to use MIME::Lite yourself). Matt has never fixed formmail to a satisfactory degree, and shows no inclination toward doing so.

If you roll your own, it'd

Beware of disability advocates

[bluelip]

People fighting for those who have difficulty seeing have been complaining about the sites that have a person type a number displayed in an image to verify that they're not a bot. They say it causes undue hardship on sight impaired folks. That may not be a legal fight your company would like to enter.

I can see both sides of this. Can't say I know where to stand though.

Re:Beware of disability advocates

[glivings]

The problem with having e-mail addresses encoded in images goes beyond excluding the blind. People with text-only browsers (a la lynx), screen readers, PDAs, cell phones, etc. are all excluded.

It's important to remember that web pages are not always rendered visually.

Un-what?

[devphil]

replacing all mailto: links on our website with something unharvestable (i.e. 'user (at) address'

What makes you think "user at mail dot foo dot com" is unharvestable? The web archives of all the development mailing lists at gcc.gnu.org use that scheme, and we still get spam to unique addresses used only for sending mail to those lists.

It's a handy technique, and useful, but it's certainly not foolproof.

Missing the point

[jtheory]

You have to consider the trade-off of the inconvenience of your readers/customers with the amount of spam you get.

I have a few websites with my email address all over them, in mailto links. I "mask" the email very lightly, by escaping most of the characters, and it has worked beautifully.

Here is a webpage [rochester.edu] that will quickly convert your mailto link into a form that bots will miss.

Could a bot be written that would be able to harvest these email messages? YES. But would it be worth the spammer's time to code it? NO, so it probably won't happen.

Put yourself in the spammer's shoes (or slime-covered bedroom slippers). Why would you want to go to a lot of work to build a bot that will harvest the email addresses of the very people you don't want to get your spam, because they will report you to spamcop, harass your ISP, and even hack your computer and post some very unattractive pictures of you [freewebsites.com] on the internet?

No, they want the chumps, and they want to find them without needing to check every webpage for dozens of patterns.

Re:Missing the point

[zcat_NZ]

Could a bot be written that would be able to harvest these email messages? YES. But would it be worth the spammer's time to code it? NO, so it probably won't happen.

You wish.

Just like the mailing list archives that cloak everyone's address "foo AT bar DOT baz". They don't get harvested quite as frequently by the regular web-crawing bots but they DO still get harvested, because someone notices that they can get a few hundred email addresses from that archive with a fairly small amount of programming.

As s

The other cost/benefit

[jtheory]

As soon as any reasonable number of people start using the same scheme (and particularly if it's a mailto: designed to still be machine-readable) someone will take the time to harvest that kind of obfuscated address. It's just a matter of the cost/benefit ratio being high enough to make it worthwile.

I think you're right as more websites use automated obfuscation; then the spammers need to decode it to get to their victims. But as long as most websites aren't doing what I'm doing, I know they don't want t

Re:The other cost/benefit

[Cecil]

Anyone who is too lazy to read the image of my email address I provide rather than just clicking on it probably didn't have anything important to say to me anyway.

There are way too many ridiculously lazy people around these days.

Re:The other cost/benefit

[ptomblin]

Yes, all those "ridiculously lazy people" who can't even be bothered to get eye transplants, or who can't be bothered to invent a high resolution screen that fits on a PDA so they could use a graphic browser on your site. Damn them all.

Re:Missing the point

[eugene ts wong]

You wish.

Just like the mailing list archives that cloak everyone's address "foo AT bar DOT baz".

I think that a partial solution is to speak about email addresses in a more casual form. For example, if my email address is [e-mail] then I should tell people that they can contact me @ foo @ bar biz baz. You should have noticed 2 things.

Notice that there is no word, "dot", in there? That's because most people should already be able to figure it out on their own. If they can't then they shouldn't be usi

/.'s obfuscation is harvested so why not?

[DrSkwid]

I've had email sent to me via the address I posted here and /. auto obfuscates it in various ways.

It is retarded to think that "fred at sheila dot com" won't get converted.

Once one has written one's harvester, it is prudent for one to inspect the results and tweak it.
It's for profit not fun! If it is possible to increaes the yield in *any* measure it will be done by someone somwhere.

Re:Missing the point

[An Anonymous Hero]

Here is a webpage [rochester.edu] that will quickly convert your mailto link into a form that bots will miss.

You know, there is a concept here. "STOP SPAM FOREVER IN TWO EASY STEPS:

• enter your email adress HERE
• click OK!

This is the BEST, FOOLPROOF way to NOT GIVE YOUR ADDRESS AWAY!!"

Server side scripting

[mikeswi]

Any method of munging the address must still be clickable within the visitor's browser. If it is clickable, it can be harvested. Javascript and html encoding may stop most of the bots, but bots exist that can slurp the address no matter how much javascript you wrap it in.

I use a PHP email form that never sends the address to the to client accessing it. Short of hacking the server and looking at the php script in plain text, there is no way to harvest the address. I have no need to let the public know my a

Re:Server side scripting

[trompete]

It's funny cause writing mail scripts is so easy with the PHP mail() function. Make sure that you hard-code the email address in the script (not as a hidden field), and you'll be set!

simple js

[anim8]

<script>
<!--
var u = "sales" ;
var d = "example" ;
var t = "com" ;
var a = u + '@' + d + '.' + t ;
document.write('<a href="mailto:'+a+'">'+a+'</a>') ;
//-->
</script>

Re:simple js

[xingdiego]

I recommend the above method plus:

1) Randomize the variable names for u, d, t, and a
2) Randomize the position of var XX = XX statements.

This will reduce simple regex replacements if you site is big enough with enough emails that someone would want to create a simple reg mod to harvest it.

Re:simple js

[Komarosu]

Ahh yes but it looks like spammers have worked around that one too. We've got a similar scheme like that on our website but still our sales address (which is only advertised on that one site using that scheme) still gets about 4-5 spams a week. Yes its not alot but still you can harvest it.

maybe, just maybe

[DrSkwid]

they spam :
info@yourdomain
sales@yourdomain
help@yourdom ain
webmaster@yourdomain
postmaster@yourdomain

etc.etc.

Re:simple js

[arkanes]

If I were a spammer who was interested in doing that I'd use the IE engine as the base of my harverster, which means that anything you can click on and have work with be harvestable.

Re:simple js

[bill_mcgonigle]

There's a nice open source javascript engine a talented programmer could easily build into his harvester. Evaluate the document, then crawl it.

Arms races are rarely effective.

Re:simple js

[bill_mcgonigle]

It results in a slower bulkier harvester that is more inclined to crash.

I agree it would be much slower, but the folks who sell harvesting tools are going to have to keep adding features to keep their customers coming back for upgrades. Unfortunately, the most people who protect themselves with this method, the more likely it will become part of harvesters.

The harvester would only share the crash risk a browser does. I haven't crashed in javascript code since the Mozilla guys fixed a stack recursion bu

Hiveware's Enkoder

[jpsowin]

Just use this [hiveware.com]. Life is good, eh?

Re:Hiveware's Enkoder

[dimator]

This is a really cool idea, actually. Two things though: it increases the document size a good deal, since the my email address (19 characters) becomes a 1383 character string. This could really add up if you had more than one email address on the page (such as a mailing list archive). Although, in the world of broadband, thats a small price to pay.

The other thing is, if you are using this, you'd be wise to change the string 'hiveware_enkoder' to something unique. The reason being, if spam harvesters really wanted to, they could recognize that string, and have their own javascript engine [mozilla.org] handy run the script to get at the email address hidden inside. That's a lot of work, but not entirely impossible. If the Hiveware system gains many users, it might be worthwhile for them.

There is a simpler one

[zhiwenchong]

This one doesn't use Javascript at all. And it's only 4k.
Obfusticated Email Link Creator [tripod.com]

It does mixed dec and hex. Creates links like this [mailto]. But check the underlying code....

It's a Tripod site, so don't /. it.....

Re:There is a simpler one

[WTFmonkey]

For those who don't want to look at source,

<a HREF="mailto:te%73t%40t%65%73%74%2E%63%6Fm" TITLE="mailto">this</a>

I use an image

[Kris_J]

My personal site uses a simple image of my email address with no link. So far no spam, but the odd real email. Even if it does start getting spam, it's a Spamcop address. At work, we have a generic text-only active link as you would expect for reception. For individual emails you need to be logged onto our student/staff portal.

Meanwhile, I'm keeping an eye out for the next technology to replace email. IM was promising about five years ago, but went to hell faster than email.

Re:I use an image

[Hallow]

I'm guessing your image doesn't have a proper alt tag for screen readers, so that begs the question: why don't you want to receive email from blind people?

Think before you do something like this people - first it's not section 508 compliant (if your site needs to be), and secondly it's just not nice to exclude a whole bunch of disabled people.

Use a form instead that mails you their input - never reveals their email address, and is accessible.

Fraid Not

[tomblackwell]

It doesn't beg the question. "Begging the question" is making a logical argument that depends on the assumption of that argument's truth as a pillar of that argument.

Instead of "begging the question" it just "makes you want to ask".

Re:Fraid Not

[arkanes]

I'd be interested if you could up with definitions of "begging", "the", and "question" to support you hypothesis.

Re:I use an image

[Alpha27]

Because it would then be a waste of my time sending them p0rn. No screen reader can interpret the pics... yet. ;=)

Uhh...

[babbage]

Quoth the original message...

What are others doing with this issue? We would prefer to preserve mailto link clickability, but also only want to make this adjustment once." One suggestion I would make is to put your email address in an image. People can read it, but harvesters won't be able to harvest it (unless they download the image for OCR)

Err, doesn't this exactly not meet the given criteria? The guy wants links to be clickable. If you hide the image, you can only get as far as, say:

<a href="mailto:[e-mail]">
<img src="email_addy.png">
</a >

But that's just as easily harvestable as it would have been if you left the visible text as the plain address. What's the point?

It's the contents of the href attribute that need to be obscured, not the visible text (or image, or video clip, or whatever). You can't embed an image in the href text, so I don't see how this suggestion gains us anything at all.

---

The suggestion I like best is to encapsulate the address as HTML entities. Currently, this is enough to fend off the average address harvesting software, though if the practice catches on, I assume that the harvesters would start to take this into account -- at which point I don't know what the solution should be...

Barring that, it seems like the only way to provide an address will be to use literal text such as "write to us at foo at bar.com" and hope people just get it.

Alternatively, shy away from giving out your address, and provide a form where visitors can submit comments. This could allow you to filter out some of the incoming traffic (hint, if you're going to use "off the shelf" software for this, use NMS [sourceforge.net] instead of Matt Wright's ancient Formmail.PL script, it's much safer). Avoiding any publication of email addresses might piss Jakob Nielsen off, but under the circumstances I think it's probably a reasonable approach to the situation -- it's way to easy for a public address to get abused...

it works like this

[metalhed77]

or maybe you could have a non-clickable email link that is just an image. I believe that is what poster was referring to.or if you really wanted to have it clickable, have it look like this

<a href="wewillnevergethere.html" onclick="alert('myreal' + '[e-mail]'); return false;">
<img src="pictureofemailaddy.png" />
</a>

See it works. Note, it is important to concatenate the email address as i'm willing to bet mailto harvesters don't parse it out as being javascript. The extra obfuscation

Re:it works like this

[FrenZon]

Alternatively, to keep it transparently usable by end-users, you can just do like this:

<a href="[e-mail]" onmouseover="var a = 'in.com'; this.href = 'real@doma'+a;">email me</a>.

Re:it works like this

[FrenZon]

In a flash of brilliance, I left out the mailto: .. but you get the idea.

Great Idea

[metalhed77]

Great way of handling it. I'd still use an image or spam armored text for the actual address though. Not all browsers have JS turned on. But killer way to implement it. I knew my JScript knowledge was substandard.

Re:Great Idea

[arkanes]

Simply put: if an IE user can click on your link and have it work as a mailto, then it's harvestable. This is the spammer equivilent of the analog hole - there's no 100% workaround.

And even if you could prevent automated harvesting, theres still people who'll do things like pay stay at home moms to harvest manually from mailing lists and archives.

Re:it works like this

[FrenZon]

Only users with a Javascript enabled graphical browser will be able to email you.

If this is the case, you may put a notification and workaround instructions in the title attribute for the link, which most text browsers should pick up.

Re:it works like this

[FrenZon]

That would be the "alt" attribute.

No, it would be the 'title' attribute - 'alt' applies to images, forms or applets. 'title' applies to things like links, which are what we were talking about.

Re:Uhh...

[Webmonger]

You can't embed an image in the href text, so I don't see how this suggestion gains us anything at all.

Actually, you can.
data URL examples [mozilla.org]

Sick, eh?

Don't bother, it's too late

[menscher]

They already have your email address. They'll get your new one when you post to newsgroups, to mailing lists, when your virus-infested friends spew it around the net, and when you register software. Focus on solving the problem (by developing anti-spam software, by lobbying for laws, or by shooting spammers), rather than on trying to find new ways to hide.

Re:Don't bother, it's too late

[Rick the Red]

No kidding. Comcast gives us seven email addresses, so I set one up for each of us. My three month old gets spam, and nobody has EVER used that account (except me sending a test email when I first set it up). These scum just take a brute-force approach to generating email addresses, and don't care how many are undeliverable. They come with opt-out buttons, but all those do is confirm they found a valid address, and they never send from the same address twice, so adding them to a filter list doesn't work either. Bayesian filters on the content is the only way to go.

Re:Don't bother, it's too late

[bscott]

> Bayesian filters on the content is the only way to go.

Aren't most of the spams filled with random gibberish these days specifically targeting Bayesian filters? My Mozilla client filter was working better and better for awhile, but lately the trend has been reversing... anyhow, I disagree that it's the "only" way to go.

I think collaborative filtering (no link, I've read about it in the past but can't be bothered to look up a good example at the moment) will become a major tool. Also, why has nobody

Re:Don't bother, it's too late

[Rick the Red]

effectively DOS-ing any spammer's server

That sounds good, until you find some Microsoft security hole has allowed a spammer to use your PC to send their filth for them. This approach would only DOS another of the spammer's victims (this includes the hapless ISP who didn't know they had a spammer as a customer, and all of that ISP's legitimate customers). That's worse than the blacklist vigilantes.

You're right, Bayesian filters are not the "only" way to go, but I think they'll prove to be the most effectiv

Amen, brother!

[Trillan]

Security through obscurity is always a bad idea.

The trick is finding the right combination of tools to automatically reduce your spam to managable levels. If I get just one or two pieces of spam a day, I'm happy.

How I do it...

[Pathwalker]

I've been looking at a couple of different techniques over the past year or so. They are closely tied into the Roxen Webserver [roxen.com], and probably won't work with Caudium [caudium.org], or any other webserver.

The first technique I used (described here [ofdoom.com]) was a simple RXML macro, that defined a tag called <cloak>. It would check to see if the client was on a list of known robots. If the client was a robot, a graphic version of the email address would be returned. If the client looked like a normal browser, then the address would be entity encoded, and returned as a mailto link.

Shortly after I set that up, I realized that entity encoding was pretty much useless - that if a web browser can figure out the address, so can a spam bot.

My second attempt appears to be working well. I wrote a Roxen module called mailcloak [ofdoom.com] which takes addresses, and replaces them with a graphic link to a dynamically generated form to send an email to that address.

As an example, the code <mailcloak> [e-mail]</mailcloak> would be replaced with a graphical version of the address [e-mail] and a link to this [ofdoom.com] page.

It also has support for finding and cloaking bare addresses in pages, and I'll probably add support for rewriting mailto tags sometime in the next few weeks.

Use a Form

[Alethes]

I recommend that you use a form that does NOT have the user's email address in a hidden input. Just have the user's ID, then on the server, find the address based on that ID and send the message accordingly. I know you want to keep the mailto: link thing happening, but if you do that, harvesters will always find a way to decode whatever you're doing.

Re:Use a Form

[Specialist2k]

More importantly, this technique will prevent spammers from abusing your form mailer to send out spam to arbitrary recipients...

disposable email addresses

[donutz]

Use an email address on your website that you don't use anywhere else. If you do start to collect spam there, change to a different email address.

Might be interesting to try encoding the month and year into the email address, and change the address each month. That way you could get some measurements of how much those addresses are being harvested for spam. Who knows, maybe you'd find out October is a big spam harvesting month, when you get deluged with spam to [e-mail] over Thanksgiving

Hivelogic Enkoder

[jcbphi]

I use some variant on this encoder from Hivelogic [hiveware.com], where the whole address is encoded into javascript, which needs to be executed to decode any part of the name.

The downside is that javascript is necessary to read any portion of my email address, and it only works if spambots refuse to execute arbitrary javascript. But in a year of use, I haven't had any problems with it, and my primary email address is remarkably spam-free. Nothing the spam filters can't handle anyway.

In message forums, etc, I just don

Re:Hivelogic Enkoder

[Yottabyte84]

this script reqires a mail deamon that delivers [e-mail] to [e-mail].

#!/usr/bin/perl -w

use Socket; # Load socket functions
use CGI qw(:standard); # Load CGI standard functions

my $name = "harvestbait"; # yourname
my $domain = "example.org"; # yourdomain.tld

my $ipaddr = $ENV{'REMOTE_ADDR'}; # Get the requester's IP
$ipaddr = unpack 'H*', inet_aton($ipaddr); # Convert the IP to hex
my $date = `/bin/da

Lil' CGI thingy.

[dbirchall]

For years (literally, since the late '90s - to my knowledge I was among the earlier people to do this) I've simply done something like this:

<a href="/x.cgi/mailto:abuse@localhost">mail me</a>

And then had x.cgi be a PERL script that generated an HTTP "Location" header to the real mailto: URL.

If I wanted more complexity, I'd substitute in whatever I felt like for the @ in the address, and have the PERL script un-do that. It's probably also doable in PHP, shells, TCL, or whatever. I like to

Use Flash!

[zsazsa]

I've only seen flash used for spamproof mailtos on one or two sites, but I think it's a pretty good idea as long as all of your users have the Flash player. Just make a little .swf of clickable text linking to the mailto: you want. You probably can even have them dynamically generated if you have a lot of different address across your site. PHP, for example, can do this with its built-in Flash functions [php.net].

You insensitive clod!

[BladeMelbourne]

I dont have an email address or a website you insensitive clod! Oh wait, I do.

My php based site has a form that allows people to email me. They never get my email address until I reply to them.

My previous site was only allowed [X]HTML, no PHP/ASP. To combat harvesters, I had in my XHTML:

<a href="javascript:emailAuthor()">Email Author</a>

Then, in an embedded JavaScript file (email.js) I had:

function emailAuthor()
{
document.location.href="mailto:" + "username" + "@" + "domain" + ".com"
}

Unicode

[vitaflo]

I actually just use unicode for the @ symbol (&#064;). It seems that most of the time the harvesters just read the HTML source, and don't actually render HTML entities or unicode. Thus the harvester will get user&#064;example.com, a non valid address, but a user on your site will see [e-mail] and the mailto: link will function normally.

Unicode actually works!

[aquarian]

Believe it or not, this actually works. These days most harvester programs still don't read Unicode. Once I started doing this, I saw a great reduction in spam. It won't work forever, of course -- eventually the spambots will read Unicode, and the game will be over for this technique. But in the meantime, it's easy enough to do a search and replace of every "@" symbol.

If you want to convert your whole address, E-cloaker [codefoot.com] is a neat little free program for converting text to Unicode.

Not for Netscape 4

[extra88]

I haven't checked the stats recently but Netscape 4.x and earlier does not supports Unicode. Pretty much all browsers can handle the HTML entities given in other examples. You may not care.

Put it in a table

[venom600]

One of my colleagues came up with the following the other day:

If you put your email address in a table with the border set to '0' cell-padding and cell-spacing also set to '0', then it will still be readable by humans. But, the code to create the table will obfuscate the address enough that it won't be harvestable.

Oh yeah been there done that

[mnmn]

How are You Preventing Mailto-Link Harvesting? I'm not. I just put up my address on the website and started manually cleaning 40 emails daily. Life was good until I started bothering this guy on eBay to send me my ATM switch 3 months after I paid for it. The day after I threatened him with legal action, and ever since, Ive been receiving 1200+ Microsoft subscription-type spam daily. Short story that particular address has been shut down permanently thus I'm losing possibly good traffic to me. All of a su

Re:Oh yeah been there done that

[mnmn]

Switch? No I think Ive lost the $50. I'm budgeting for a new one.

Here is what we do

[wolfson]

Here is the php code that I use on Aginet.com [aginet.com]

function gen() {
mt_srand(make_seed());
$x = "aginet3";
$list= "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLM NOPQRSTUVWXYZ";
$x .= $list[mt_rand(0,61)];
$x .= $list[mt_rand(0,61)];
$x .= $list[mt_rand(0,61)];
$x .= $list[mt_rand(0,61)];
$x .= $list[mt_rand(0,61)];
$x .= $list[mt_rand(0,61)];
$x .= $list[mt_rand(0,61)];
echo "<a href=\"mailto:$[e-mail]\">$[e-mail]</a> ";
$x .= "\t" . date("m/d/Y h:i A");
$x .= "\t" . $_SERVER["REM

blocking mailbots

[engine matrix]

I have a 1 pixel transparent gif link at the very top of my page that links to /guestbook/jackhole. In my robots.txt file I have "User-agent: * Disallow: /jackhole/ Disallow: /jackhole/guestbook/". When a harvester traverses this link their IP is added to a text file via a php script that I wrote and they immediately get a 403 page.

Each page of my site checks against this text file so the mailbot gets a 403 page for almost all pages/sites that I host. To deal with false positives there is a mailto link on

stuff

[falsification]

You could try using your IP address, in the form of:

a href="mailto:joeblow@[10.0.0.1]"

Substituing your IP address, of course. Maybe spam harvesting bots would fail to treat that as a valid address.

On another note, this is a CGI thing that looks interesting: Master Spambot Buster [willmaster.com].

Operation Barndoor

[Door-opening Fascist]

I'm one of the sysadmins for a CS department [earlham.edu] in a liberal arts college [earlham.edu]. I've been working with the web content admins off and on for a couple months as they prepare a system that will execute a Perl script to generate an image that will replace the e-mail address. The project is still in its infancy, but here's the URL to the description, and here's the URL to the current version [earlham.edu] of the project, in gzip'd tarball format.

Images are probably the easiest all around.

[WoTG]

For simplicity, an image is probably best. Heck, with PHP (and probably other web languages) you could probably hack up some code to automatically create the image for you (more useful if you have a large number of addresses to display).

For folks who won't be able to handle the images, you could put some human decipherable text in the "ALT" or Title text of the image- e.g. jim@_REMOVE_ALL_OF_THIS_23421232_me.com.

Re:Images are probably the easiest all around.

[Zocalo]

The use of an image is good (for the non-vision impaired), including a poorly munged ALT tag is not so good. Any spam harvesting robot is not going to be bothered too much about the page layout, it's just going to be looking for regexps that look like email addresses. "jim@_REMOVE_ALL_OF_THIS_23421232_me.com" is a very recognisable email address, and the mixed case is a sign munging is going on.

Personally, I think this is a case of diminishing returns. Putting your email address in clear text on a mail

Re:Images are probably the easiest all around.

[MImeKillEr]

Which JS does this?

Re:Images are probably the easiest all around.

[Zocalo]

'
a+='lto:'
b+='@zocalo'
e=''
b+='.uk.com'
d=b
document.write(a+b+c+d+e)
}
escramble() //-->

Re:Images are probably the easiest all around.

[Zocalo]

Let's try that again... Clicked "Submit" instead of "Preview" thanks to the damn Citrix display lags... Still, at least I know what tags need work now! Anyhow, the following obfuscates the email address "[e-mail]":

<script>
<!--
function escramble(){
var a,b,c,d,e
a='<a href="mai'
b='no-one'
c='">'
a+='lto:'
b+='@nowhere'
e='</a>'
b+='.com'
d=b
document.write(a+b+c+d+e)
}
escramble()
//-->
</script>

Re:Images are probably the easiest all around.

[MImeKillEr]

Thanks!!

blind people

[kipple]

already have a lot of trouble with that picture-of-the-email-address thing. it is a neat solution but it lacks portability, to state it another way.

Bring it on.

[CGP314]

On my London Blog [colingregorypalmer.net] I don't use any form of obfuscation. The reason for this is I want people to contact me about my writing. I want to know what people think, and barrier I put in the way will reduce the number of legitimate emails I get. I'm not confident that most of the Internet population would understand that they need to remove the REVOVE.THIS.TO.EMAIL.ME part of my address.

Sure, I drastically increase the number of spams I get, but popfile [sourceforge.net] takes care of them all.

Re: do you really want that?

[ubiquitin]

If you're running a mail server with, say, 250 people doing what you're doing, the spam connections might very well denial-of-service your mail server, assuming it is running on a typical T1. The expense of bandwidth, not to mention the inconvenience of less-reliable mail, is what leads sysadmins and the companies who employ them to take email obfuscation seriously.

unicode, base-64 encoded

[ubiquitin]

I have a unicode [phpconsulting.com] converter that works really well. It will put your email address into a form like:

& # 105;& # 032;& # 100;& # 111;& # 032;& # 105;& # 116;& # 032;& # 116;& # 104;& # 105;& # 115;& # 032;& # 119;& # 097;& # 121;

For the past three years or so, the spammers haven't caught on to this, and they are unlikely to do so given the few people who take the effort to put this measure into place.

P.S. It's not just mailto links that are being harvested here. They'll scrape anything with an @ or a "at" or ...

Fight the problem, not the symptoms

[Baloo Ursidae]

Focus on reporting, not prevention. You'd be amazed how quickly making yourself a hostile target gets spammers to stop spamming you.

Also, don't munge [interhack.net].

Deal with the symptoms and the problems

[plover]

Sorry, but that "don't munge" [interhack.net] page is hopelessly outdated, and its advice is useless at best (although I have to admit being highly amused by the "if you munge your address then the terrorists have already won" attitude!)

Back when the 'net was young, and there was hope for stopping spam before it snowballed out of proportion, it was hoped that this naive "nip it in the bud" attitude might work. It hasn't. Spammers have proven as resilient as cockroaches, and more prolific.

Keep in mind who is paying

See my sig.

[bobv-pillars-net]

The nine domains for whom my email is the catch-all address receive an average of a hundred spams a day, but I don't see them, thanks to a Bayesian filter [sourceforge.net].

Any spammer who harvests the email address in my sig [mailto] just registers their latest spam so that I (and the dozen-odd other people who use the same filter) are that much less likely to see it.

Accessibility

[Hallow]

Cliff's suggestion of using an image for the email address doesn't take into account that not every visitor to your site is necessarily sighted. This is a bad, bad, BAD idea. Preventing mailto: harvesting by excluding people with visual impairments is not the way to go.

The best method is to use a mailto form that allows you to receive the message but doesn't give away your address. That way you leave your site open and accessible to all users, but can protect your email address.

Re:Accessibility

[MImeKillEr]

Agreed, except I'd add that you obfuscate the address in the form. I'm the webauthor for my in-laws lamaze business and to prevent harvesting, I put site feedback in a form and obfuscated the email address.

In the year or so that the site's been up, I've not received a single bit of spam.

Sure, I had a couple of people input bogus information attempting to get the address from the results page, but that doesn't show them anything except a thank you message.

I can't seem to locate the link I originally used

I don't bother.

[Fweeky]

See my address up there? Yup, I'm not letting a few scumbags reduce my ability to use the Internet. I filter so much that I barely notice any more.

Of course, I take more care with other people's addresses; using mailto forms, intra-site private messaging systems, one-time-only addresses, that sort of thing. I also wrote a bit of PHP to munge email addresses (phps [aagh.net]/php [aagh.net]), but I don't actually use it.

You XHTML users better not be using these JS "solutions" which use document.write() by the way (that's HTML

My solution...

[cmowire]

I provide two options.

1) I have a mail form. It will only send to one mail address, it's not anything like formmail.pl.

2) I generate a unique email address with the IP address and time encoded in it. I actually could use spamgourmet to do this, but I've been doing things by hand because I want to collect some observations about how far a single address travels.

bad solution

[anthony_dipierro]

One suggestion I would make is to put your email address in an image. People can read it

Unless they're blind! Yeah, yeah, no one cares about the blind, you insensitive clods.

After the harvest: broadcast seeding

[unfortunateson]

As a domain name owner, I have found that our basic "[e-mail]" doesn't get a huge quantity of spam. Perhaps the spammers recognize that as a corporate entity or something, because it's not so bad.

But it mutates: [e-mail], [e-mail], bob37, jenna624, etc. etc. Most of the spam we receive isn't to one of our known addresses. But we don't want to lock down all but a few (sales@, help@, webmaster@, orders@, myname@, hername@) so that we can help the poor sods who misspell "orders"

The solutions we offer here will not solve the....

[Alpha27]

problem.

The issue isn't with the emails getting harvested. The issue is with a global infrastructure that uses an old policy of sending emails.

We need a new improved protocol that does a level of authentication at the host/isp level to say, this is a legitemate server with an emal from an acceptable user. All isps should be held up to a spam policy enforcement where if a user violates the policy, are automatically terminated, and their name, with evidence provided of course, is sent to a spammer list syst

Re:The solutions we offer here will not solve the.

[Alpha27]

No solution is absolutely watertight, and I know it's not going to happen anytime soon, but the current suggestions mention will create an ongoing situation.

I create uber mailto style 1, a some time passes and I find it's no longer working. I create uber mailto style 2, a some time passes and I find it's no longer working. I create uber mailto style 3, a some time passes and I find it's no longer working. I create uber mailto style Nth, a some time passes and I find it's no longer working.....

The solution

low tech solution

[ArmorFiend]

I simply create a PNG, JPG, or GIF with a picture of my email address. No they can't copy-paste it, but you'd have to be a really dedicated address-farmer to automatically harvest that.

My suggestions

[macdaddy]

For starters NEVER give out any addresses other than addresses for role accounts (webmaster, abuse, postmaster, hostmaster, sales, support, etc). This is Rule #1. Don't violate it, ever. Instead provided email forms for people to mail individual users within your organization. Your company policies (especially the security policy) might even prevent you from posting employee names on the website in a directory format. Look into this.

Secondly, anything you do to obscure a user's email address will eve

Any Standard is bad

[pagercam2]

If you always repalce @ with at then the change to the spambots is minimal and they get the address anyway. Many websites only display the beginging of the mail address and registered users must request the full address or use a mail entry screen to forward the email to the user without devulging the email at all and giving them privacy until they want to respond to you (your email is entered and provide as the replyto address.

Spam magnet

[retrosteve]

This works if you have your own domain. Thanks to Andrew for this idea: Put the harvestable email on your site. Also, on the same site, (less conspicously), post a similar email address, with the same domain and a similar username. Don't ever give out the second address, it's just for spam. The magnet address may be in the code but not visible, for best effect. Or make it a real mailto:link, but in invisible color and font.

Write a small filter program on your site that stores all spam coming from th

that's a start..

[josepha48]

I'd use web forms and split stuff up if cgi is an option.

Start with to contact so-and-so clieck here. Have the users name embedded in the email form and the second half you get from the server. So if the user was [e-mail] the web form would have a hidden input called loosername and its value would be thomas. Call it something different than loosername, but the idea is that you don't want to just say username. When the web form gets posted you can have it read a text file (this is what e

"block images from this server"

[KnightStalker]

I suspect you're using an ad-blocking browser or proxy, which has blocked the image itself but has left a large (clickable) white space that would be the image if you hadn't blocked it. That's the behavior Firebird shows for me, blocking ads.osdn.com. If you're using Mozilla or Firebird, and you right-click on the "background" I think you'll find "block images from this server" or "block images from ads.osdn.com" checked.

Re:my method... entertaining and it works well

[Trillan]

The best part of that is that if someone can't work that out, you probably don't want to talk to them anyway... :)

Re:Javascript mailto links... vulnerable?

[Specialist2k]

There are e-mail harvesting bots which use the Microsoft HTML ActiveX control, so they can and will execute any JavaScript present on the page.

Wait... this provides some nice opportunities to cause them a major headache by including malicious JavaScript code on a page only seen by a bot not following the robots exclusion protocol [robotstxt.org] (to prevent a "real" search engine spider from visiting the page) by linking to that page using some hidden link from your home page...

Re:Javascript mailto links... vulnerable?

[merlin_jim]

this provides some nice opportunities to cause them a major headache by including malicious JavaScript code on a page only seen by a bot not following the robots exclusion protocol

A lot of people do that with a malicious honeypot page. It just outputs X phony, but real-looking, mailto links, where X is a member of the set of Very Large Integers.

(note to /. math freaks: yes I know there's no set called Very Large Integers. It's a joke. Laugh.)

Re:Unicode your email address

[Alpha27]

Unicode is not supported in all browsers, especially the older ones.

Re:JavaScript tricks

[plover]

"Address harvesters" in this context are not people sitting in front of web browsers. They are programs, and they are not based on rendering engines such as Mozilla or IE. These programs are dedicated web crawlers that open sockets to web servers, pull in data, recognize a limited subset of tags that represent links to more pages, and attempt to perform character recognition on text strings that resemble valid email addresses. When they find text that looks like this: href="mailto:[e-mail]"

Re:Plug

[greenhide]

Hey, guess what.

I was able to use your form to send myself spam!

That's right.

I entered my e-mail address, a from address, and the mail went through.

Essentially, your web page is providing the equivalent of an open relay.

You need to remove the "mailto" field, as that allows the form to be used to send out an address to anybody. Once that's gone, your form should be secure again.