Email obfuscation: What works in 2026? • Hacker News Board

Re: Email obfuscation: What works in 2026?

#101

Post by Croak » Thu, Apr 02, 2026, 6:42 PM UTC

MichaelApproved wrote: post #44

Croak wrote: post #28

One trick is having an tarpit email adress on your website. It is hidden using CSS so no real visitor sees it but it is visible in source. If your mail server recieves mail for that adress you can just block that IP for 24h.

This sounds like bad advice and would result in blocking google and other major ESPs. I occasionally get spam from people who took the time to create gmail accounts. Based on this advice, the honey pot email address would get spam from a Gmail account and your script would block Gmail servers.

There exist lists of email providers. Those you can whitelist, ie. they can't get on the blacklist. Even then they would only be blocked temporarily. There also exists postmaster@domain.com which should not filter at all. I am aware that you are able to abuse said system but if you monitor logs those issues would only be temporary.

Re: Email obfuscation: What works in 2026?

#102

Post by TZubiri » Thu, Apr 02, 2026, 7:07 PM UTC

What I do is I have a catch all, and based on the emails I get, I know which emails are made public, and I scout what the threat actors are doing.

For a similar reason I dislike ip2ban, my objective is not to block all attack attempts, I prefer receiving them acknowledging them and being immune to them.

The idea of ignoring attack attempts isn't very safe when you think about it, your body doesn't do that, it creates antibodies upon subclinical expositions. Complete isolation means your immune system is weak and you are more vulnerable to the lightest of exposures.

Re: Email obfuscation: What works in 2026?

#103

Post by dyingkneepad » Thu, Apr 02, 2026, 7:23 PM UTC

djha-skin wrote: post #99

It's simple: draw your email in a paint program and export it as a png. Totally readable by humans.

Then I can't copy+paste, so I might make a typo when sending you a message.

Re: Email obfuscation: What works in 2026?

#104

Post by momo_dev » Thu, Apr 02, 2026, 7:39 PM UTC

interesting that most scrapers are still just regex-searching for @ in raw bytes. on the receiving side i've been dealing with a different angle of the same problem, blocking disposable/temp email signups. a domain blocklist catches 90% but the clever ones use random alias domains that all point their MX records to the same disposable mail infrastructure. checking where MX records actually resolve catches those too

Re: Email obfuscation: What works in 2026?

#105

Post by bornfreddy » Thu, Apr 02, 2026, 8:06 PM UTC

cyberlimerence wrote: post #56

ghywertelling wrote: post #51

Earlier quoted context omitted.

Is that even possible? Shouldn't the recipient email id need to be created first to be addressable?

Of course, the technical term for that setup is 'catch all', you can set this up with your email provider. You can send your email to "ghywertelling@gregegan.net", for example.

A friend gave out an email gmail@hisname.com (he owns the domain). He says it's incredible how many people "corrected" him, and how persistent some of them were. :-)

Re: Email obfuscation: What works in 2026?

#106

Post by BeetleB » Thu, Apr 02, 2026, 8:18 PM UTC

ProllyInfamous wrote: post #88

Really surprised this [very well-written] article didn't suggest the fantastic technique of owning an entire domain (although author's own examples obviously include unique handles@ for each tested practice). Then you can hand each recipient an absolutely unique email which isn't just ole "name.morewords@" period trick — block those which receive SPAM. ---- OR: the even "easier" lifestyle of just not using email (lik…

Years ago, I considered your approach. Programmatically create a custom email address for each person I wanted to talk to.

Then I hit upon a simpler solution. Have one email address. Happily share publicly. And whitelist the sender's email addresses. Emails not in the whitelist go into a quarantine folder that I glance at once in a while.

It's almost equivalent in efficacy, but much simpler to implement.

Re: Email obfuscation: What works in 2026?

#107

Post by woctordho » Thu, Apr 02, 2026, 10:50 PM UTC

robotswantdata wrote: post #34

binaryturtle wrote: post #26

When I wrote my own brainf*ck interpreter (in C) at the start of the year I was really struggling to find a use for the language. Eventually I had the idea to obfuscate emails on my websites with the language. Basically each email gets written as a brainf*ck program and stored in a "data-" attribute. The html only includes a more primitively obfuscated statement "Must enable Javascript to see e-mail." by default whic…

How does that work if the scraper takes a screenshot to feed to a LLM or OCR?

It would be interesting to show bf code rather than the actual email on the webpage. A lot of OCR systems struggle with this kind of repeated symbols where the exact count is required.

Re: Email obfuscation: What works in 2026?

#108

Post by ProllyInfamous » Fri, Apr 03, 2026, 1:51 AM UTC

BeetleB wrote: post #106

ProllyInfamous wrote: post #88

Really surprised this [very well-written] article didn't suggest the fantastic technique of owning an entire domain (although author's own examples obviously include unique handles@ for each tested practice). Then you can hand each recipient an absolutely unique email which isn't just ole "name.morewords@" period trick — block those which receive SPAM. ---- OR: the even "easier" lifestyle of just not using email (lik…

Years ago, I considered your approach. Programmatically create a custom email address for each person I wanted to talk to. Then I hit upon a simpler solution. Have one email address. Happily share publicly. And whitelist the sender's email addresses. Emails not in the whitelist go into a quarantine folder that I glance at once in a while. It's almost equivalent in efficacy, but much simpler to implement.

I don't have a phone ringer anymore, but when I did whitelist-only is how I screened incoming calls. Your method for email sorting has the advantage of being reviewable (verse entirely blocking specific handles@) — and much easier to implement/maintain.

Re: Email obfuscation: What works in 2026?

#109

Post by wackiness » Fri, Apr 03, 2026, 5:27 AM UTC

Personally, I saw email crawler crawls “iDOLM@STER” (a Japanese game franchise) as an email. Even Cloudflare’s automated email obfuscation system also triggers with this too. It was funny when I saw it. I had to manually disable the CF obfuscation when it happens.

Re: Email obfuscation: What works in 2026?

#110

Post by Cthulhu_ » Fri, Apr 03, 2026, 7:56 AM UTC

GeoSys wrote: post #43

ciroduran wrote: post #10

I stopped being concerned about email harvesting years ago, I just simply leave the email on my website. Spam handling is okay enough, I guess. But I like this review of techniques, even the simplest ones are very effective, that surprised me.

I agree that email addresses get leaked eventually. However, LLMs are quite good at generating spam and I think soon will evade most filters.

And so the arms race continues.