Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Email obfuscation: What works in 2026?

spencermortensen.com

Post reply on HN
Print view View original

41–50 of 124 posts

Re: Email obfuscation: What works in 2026?

#41

Post by layer8 »

newscracker wrote: post #4

> HTML entities are often decoded automatically by server-side libraries, which means that even the most basic harvesters can get your email addresses without any special effort. This technique should be worthless—and, yet, it still stops most harvesters. Anecdotal, but I’ve used HTML entities on a public static website for a long time using an href tag with mailto, and yet I’ve not seen any spam. I guess any spammer…

Same. I have a normal mailto link on a Google-indexed page (a top hit with the right search terms) with a dedicated email address for over a decade, and rarely ever received spam for it. This is after DNSBL filtering.

Re: Email obfuscation: What works in 2026?

#42

Post by hrmtst93837 »

jwr wrote: post #13

This is such a waste of effort. Your E-mail address is not and can't be a secret. It will get into spammer databases eventually, no matter what you do. You will spend a lot of effort doing all these fancy tricks, and eventually you will get spam anyway. Also, a note to those who make fancy "me+someservice@somedomain.com" addresses: make really sure you are in control and these work. Some services (including mine) wil…

[flagged]

Re: Email obfuscation: What works in 2026?

#43

Post by GeoSys »

ciroduran wrote: post #10

I stopped being concerned about email harvesting years ago, I just simply leave the email on my website. Spam handling is okay enough, I guess. But I like this review of techniques, even the simplest ones are very effective, that surprised me.

I agree that email addresses get leaked eventually.

However, LLMs are quite good at generating spam and I think soon will evade most filters.

Re: Email obfuscation: What works in 2026?

#44

Post by MichaelApproved »

Croak wrote: post #28

One trick is having an tarpit email adress on your website. It is hidden using CSS so no real visitor sees it but it is visible in source. If your mail server recieves mail for that adress you can just block that IP for 24h.

This sounds like bad advice and would result in blocking google and other major ESPs.

I occasionally get spam from people who took the time to create gmail accounts. Based on this advice, the honey pot email address would get spam from a Gmail account and your script would block Gmail servers.

Re: Email obfuscation: What works in 2026?

#45

Post by Bender »

They left off html cgi form. Generate the email on the web page and the server sends the email after performing some basic sanity checks and anti-spam on the form and web server itself such as solving some CSS puzzle or winning a game of DOOM.

Re: Email obfuscation: What works in 2026?

#46

Post by e40 »

ciroduran wrote: post #10

I stopped being concerned about email harvesting years ago, I just simply leave the email on my website. Spam handling is okay enough, I guess. But I like this review of techniques, even the simplest ones are very effective, that surprised me.

I’m up to more than 1,500 spam emails a month, with my email on the corp website.

Re: Email obfuscation: What works in 2026?

#48

Post by tgv »

I use a very simple encryption plus some padding (fluff in the article), but the email address gets updated by JS. This requires JS plus evaluating the resulting DOM. If you don't evaluate JS, the address will be something like "please@activate.javascript". Or you could use "potus@whitehouse.gov", in which case clueless scrapers end up spamming the US government.

Re: Email obfuscation: What works in 2026?

#49

Post by Gigachad »

GeoSys wrote: post #43
ciroduran wrote: post #10

I stopped being concerned about email harvesting years ago, I just simply leave the email on my website. Spam handling is okay enough, I guess. But I like this review of techniques, even the simplest ones are very effective, that surprised me.

I agree that email addresses get leaked eventually. However, LLMs are quite good at generating spam and I think soon will evade most filters.

I doubt it. Most of the signals spam filters use these days are reputation based. You have to build up your domain and IP reputation for a long time first.

Re: Email obfuscation: What works in 2026?

#50

Post by _ache_ »

curiousObject wrote: post #7
_ache_ wrote: post #5

I'm sorry, but that is not how email address are spammed in bulk. The data-source are the enormous data breach that are more and more frequent. There is more intensive to collect more information on someone you already know something about than spamming an email you don't even know if it's a valid one. The spam can also be very more effective as it present itself with personal information about the spammed.

The OP put those addresses on that web page, and only on that web page. Some addresses received spam. Edit: that’s not to deny that big data leaks are a serious problem

I'm not denying that it happens. I'm saying that it not the classical way to spam people nowadays.

It's obvious to any non native english speaker, when you have a spam in english, it is because they toke the email from the web. When it's in you native language, it's usually from a data breach.

I'm vastly more spammed by the later. I can confirm it with unique email addresses of the "+" form (but not with the + character).

Also when I'm spammed in english, it's for Web3 crypto stuff and from a data breach it's a phishing attempt.

Post reply on HN