How Do Spammers Exploit Mailto Fields?

Question

I was interested in finding out how spammers can target my Mailto link to send out spams.

mailto:foo@domain.com?subject=foo

Is it just a case of appending

?from=foo?to=victim1;victim2;victim3

to the end of the string? or would it involve something more sophisticated?

Finally, how can we prevent it?

I remember someone suggesting to use a form instead of mailto links. The way I see it, forms are still under client control and as such not an effective mitigation...(?) Am I missing something really obvious here?

Answer 1

Well, spambots scour the Internet, looking for easy pickings--plaintext email addresses and mailto: links. So, having an email address revealed to a spambot in that manner isn't a good idea. The danger is in the spambot reading the email address and sending you spam, not using the email address to send other people spam.

Yes, they can use forms for the same thing, but you need to remember that most forms have a certain expected format of input (required fields, fields get validated, et cetera). So, one needs a rather sophisticated spambot to be able to insert spam into a generic web form.

Remember that if you make it just a tiny bit harder to get your email address (text obfuscation, using an image, etc), you stop almost all spam bots. While it is still easy to get the email address, the added difficulty acts like a deterrent.