It's likely that the email the author received is pure coincidence. Especially if they are using a client that downloads emails in batches.
FWIW it looks like their validation email is sent by Customer.IO via Mailgun. Both have squeaky clean service agreements so it's unlikely they are shooting off the data to spammers.
Edit: No way! I did end up getting a random empty email. From a "Adventure-Meter Department" at bugbusterbrigade.com. The topic of the email was "Scents and Memory".
This is a really weird email. It's not a spam email, it's some sort of attempt at inbox testing. Perhaps it's an attempt to sniff out AI agents signing up for their service?
* https://mailgun.com/products/validate/
* https://documentation.mailgun.com/docs/validate/oas/openapi-...
> Catch email addresses that have turned into honey pots
> Make smart decisions on who you should and shouldn’t send to using our risk score
Identifying honeypots is tricky business. Sending something that looks like obvious spam from random burner domains and seeing if it still gets delivered is not a bad way to do it.
curl --request POST --data '{"email": "pangramdemo@milek7.pl"}' https://www.pangram.com/api/validate-email
Is it really empty? From a sibling comment by tom1337 https://news.ycombinator.com/item?id=48651560 it looks like they are using some CSS tricks to hide the text in a html email.
Partly fun part is what Panagram here has done is to expose an endpoint for anyone to transitively use the email validation API in their product
"We recheck all unknown emails using IPs from different geographical locations". This matches exactly what this article describes as getting these emails from a range of locations.
The step before that is just "Proprietary Technology", which sounds like a good cover for what's going on here. How else are you testing an email address after between "real time SMTP server check"?
If you want to verify an email, send me a one-time code with several hours expiry that I have to resubmit through my logged in web identity at your site.
It drives me batty that a financial provider (retirement vendor from previous employer) won't seem to let my "paperless" setting remain active. Only because I don't ping their abusive email tracking pixels etc.
To me, paperless means I can log in and download my quarterly PDF statements and related documents, and they won't be left in a mailbox on the street. It doesn't mean I have to subject myself to reading your silly emails with a promiscuous client.
And they are for the well-defined accounting periods, e.g. monthly or quarterly, not some sort of ephemeral "rollup to time of download". That would drive me mad if they had different periods depending on download timing.
I can't know for certain, but my gut tells me they are just generating PDFs at the same time they perform the general reporting run that also leads to printed statements. And then they have some limited retention history to limit the storage costs.
My personal tax agent only accepts forms and sends them back via email. I had a conversation with him about using password protected zips and he just told me he won't accept them.
My hospital sent me a PDF that I was to fill in and email back with cleartext credit card information filled in to pay bills. Screenshot:
https://infosec.exchange/@jsmall/116745959468132388
I recently deal with an inheritance and the Super Fund would only accept legal documents by email. I could go on, this is normal.
Having to log in to a half-maintained, slow web portal with terrible UI that is down 25% of the time is a really terrible way to get your sensitive and often important documents.
I am geeky enough to use PGP or S/MIME if they had the option, but I can definitely see how vendors would see this as too fringe with retail customers. I would not like the typical "secure email" which is nothing more than a volatile link back into yet another website.
It'd be great if there's a unified API for all financial institutes to provide sensitive info (statements, tax forms etc.) and you just need to run a software tool to download them once in a while or when you need it.
Although what I would really like, and think is long overdue, is an extension to email that normalises encryption and sender verification. It's ridiculous that email can be spoofed like that. (The same is even more true for phone numbers.)
I have a laundry list of other issues I'd like fixed in email, but I'd be happy just to get end to end encryption and sender verification.
Is it possible that they are somehow leaking the address to actual spammers?
For example, they (or the hypothetical email validation SaaS) use an infected email validation library that ex-fills every email supplied to it, or something like this.
> Hi there, A magnetic domain is a region within a magnetic material in which the magnetization is in a uniform direction. This means that the individual magnetic moments of the atoms are aligned with one another and they point in the same direction [...]
they sign off the email with a zero-width space set to "font-size: 0" for some reason
style="position: absolute; left: -9999px; top:-9999px;display: none"
maybe they try to warm up those emails to use them for other "campaigns" later on...
Part of me wonders if someone has added something nefarious into their backend which just collects and exfiltrates new emails as people sign up.
The amount of misdirected mail I get is astounding. I literally just got a delivery updaye for hair removal cream, with the option to sign the unknowing recipient up to a paid for tracking subscription service.
The problem isn't just making sure the address is valid.
You need to ensure you're sending communications to the correct person.
I wont allow you to test deliverability to my email domains without you sending an email I can analyze and decide to allow or drop mid stream. I also get to drop it before you consider it sent. I obviously drop connections that just establish from and to and go weird after that.
Sell verification services to one set of clients, and use the harvested email addresses to sell spam delivery to another set of clients.
It's like having a space in a big building downtown with storefronts on two opposite streets. Babysitting/childcare services here; rent a child to go the park with and help you pick up chicks there.
The similar playing-both-sides against the middle that I'm struggling with right now: companies sell (physical) mail addresses to other companies for beaucoup bucks. But if you want to correctly report that your wife has been dead for 9 years because you're tired of getting her USPS spam, they want to charge you to add you to their profitable database.