Email obfuscation: What works in 2026? • Hacker News Board

Re: Email obfuscation: What works in 2026?

#81

Post by curiousObject » Thu, Apr 02, 2026, 2:42 PM UTC

_ache_ wrote: post #50

curiousObject wrote: post #7

Earlier quoted context omitted.

The OP put those addresses on that web page, and only on that web page. Some addresses received spam. Edit: that’s not to deny that big data leaks are a serious problem

I'm not denying that it happens. I'm saying that it not the classical way to spam people nowadays. It's obvious to any non native english speaker, when you have a spam in english, it is because they toke the email from the web. When it's in you native language, it's usually from a data breach. I'm vastly more spammed by the later. I can confirm it with unique email addresses of the "+" form (but not with the + charac…

[dead]

Re: Email obfuscation: What works in 2026?

#82

Post by unilynx » Thu, Apr 02, 2026, 2:51 PM UTC

ciroduran wrote: post #10

I stopped being concerned about email harvesting years ago, I just simply leave the email on my website. Spam handling is okay enough, I guess. But I like this review of techniques, even the simplest ones are very effective, that surprised me.

> But I like this review of techniques, even the simplest ones are very effective, that surprised me.

because harvesters don't care until one technique gets massive use. if you come up with a unique but simple enough scheme for your sites and keep a few dozen email addresses out of their reach.. they've still gathered a million addresses. it's not really worth their effort to get the last 0.0001% of extra email addresses

so it's best to just not advertise your solution and make sure it doesn't get n any outside traction - if it gets popular the harvesters will defeat it

Re: Email obfuscation: What works in 2026?

#83

Post by nabbed » Thu, Apr 02, 2026, 3:01 PM UTC

It's odd. My email address is included un-obfuscated in ~90 commits to a popular open source repo on github. I also use this same email address for a mailing list associated with this OSS project. As far as I can tell, I've never received a single spam email in the 8 years I've had this email account.

When I view a commit on the github UI using view source, I can see the commit author's email address just as text with no special handling. It's bracketed by "<" and ">", so maybe that's enough to confuse harvesters.

I just looked at the spam folder of one my personal accounts (where I sign up for services), and it has got tons of stuff, most recently 2 or 3 with the subject "YOU PERVERT! I RECORDED YOU!".

It seems spammers are doing less harvesting and more purchasing of email lists from service vendors.

Re: Email obfuscation: What works in 2026?

#84

Post by genie3io » Thu, Apr 02, 2026, 3:02 PM UTC

[dead]

Re: Email obfuscation: What works in 2026?

#85

Post by leonidasv » Thu, Apr 02, 2026, 3:02 PM UTC

VladVladikoff wrote: post #75

This is a great list on how to make an email harvester even better.

Yes and no, some techniques are still expensive for bots that aim to extract millions of addresses per day (like running JS and CSS, rendering SVG, etc).

Re: Email obfuscation: What works in 2026?

#86

Post by curiousObject » Thu, Apr 02, 2026, 3:07 PM UTC

kqr wrote: post #55

I have a hypothesis email scrapers don't parse HTML at all. I suspect they search the raw bytestring for @ characters and take whatever's on either side of it. That probably gets them as many addresses as they can realistically use at a fraction of the cost, given how expensive HTML parsing can be. (Similarly, I'm sure most links can be found by searching the bytestring for "href" and taking what's to the right of it…

I believe you’re right. But sometimes, you really have to think about how mad your adversary is.

A dog will keep biting long after that is a disastrous plan.

Re: Email obfuscation: What works in 2026?

#87

Post by vlucas » Thu, Apr 02, 2026, 3:26 PM UTC

I recently noticed an uptick in cold emails and spam after publishing my new website. After a few weeks, I asked Claude/Cursor to obfuscate the email for spam protection in the mailto: link, and thy both used JavaScript with data attributes.

Something like:

``` ${children} ```

And then some light vanilla JS to stitch it together. Works in the browser, and spam has dropped off a cliff since.

Re: Email obfuscation: What works in 2026?

#88

Post by ProllyInfamous » Thu, Apr 02, 2026, 3:46 PM UTC

Really surprised this [very well-written] article didn't suggest the fantastic technique of owning an entire domain (although author's own examples obviously include unique handles@ for each tested practice).

Then you can hand each recipient an absolutely unique email which isn't just ole "name.morewords@" period trick — block those which receive SPAM.

----

OR: the even "easier" lifestyle of just not using email (like me). Obviously this is difficult for modern living, but that's what temp email is best for [i.e. circumventing ubiquitous `REQUIRED` email address fields].

Re: Email obfuscation: What works in 2026?

#89

Post by Macha » Thu, Apr 02, 2026, 4:00 PM UTC

nabbed wrote: post #83

It's odd. My email address is included un-obfuscated in ~90 commits to a popular open source repo on github. I also use this same email address for a mailing list associated with this OSS project. As far as I can tell, I've never received a single spam email in the 8 years I've had this email account. When I view a commit on the github UI using view source, I can see the commit author's email address just as text wit…

I have a wildcard address at my domain. The most common email addresses for spam are:

- git@mydomain.com

Presumably harvested from GitHub or gitlab

- contact@mydomain.com / admin@mydomain.com

Not actually an email address ever used, presumably people just guessing these exist from convention.

- @mydomain.com

I mean, if you know my name you can probably guess this but also this has been my primary email address for outbound email and so has ended up in marketing lists etc.

- ap@mydomain.com, finance@mydomain.com

This is a very recent trend but I've been getting emails to made up addresses like these ones quoting forged emails from myself (with various titles like CEO or CFO attached) claiming to authorize payments to other parties, usually backdated, and then asking that I process their invoice ASAP because look how long ago the CEO said it should be paid. I guess my website has ended up in some list of businesses despite being a personal site.

Ironically, the address that was in plain text in my HN profile for like 15 years gets very minimal spam.

Re: Email obfuscation: What works in 2026?

#90

Post by Someone » Thu, Apr 02, 2026, 4:01 PM UTC

kqr wrote: post #55

I have a hypothesis email scrapers don't parse HTML at all. I suspect they search the raw bytestring for @ characters and take whatever's on either side of it. That probably gets them as many addresses as they can realistically use at a fraction of the cost, given how expensive HTML parsing can be. (Similarly, I'm sure most links can be found by searching the bytestring for "href" and taking what's to the right of it…

> This would explain why HTML entities are so effective.

Could also be that they learned that sending spam to obfuscated addresses doesn’t gets much response. Such messages might get filtered out more and/or addressees might be less inclined to reply to it.