Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was interested in finding out how spammers can target my Mailto link to send out spams.

Is it just a case of appending


to the end of the string? or would it involve something more sophisticated?

Finally, how can we prevent it?

I remember someone suggesting to use a form instead of mailto links. The way I see it, forms are still under client control and as such not an effective mitigation...(?) Am I missing something really obvious here?

share|improve this question
up vote 1 down vote accepted

Well, spambots scour the Internet, looking for easy pickings--plaintext email addresses and mailto: links. So, having an email address revealed to a spambot in that manner isn't a good idea. The danger is in the spambot reading the email address and sending you spam, not using the email address to send other people spam.

Yes, they can use forms for the same thing, but you need to remember that most forms have a certain expected format of input (required fields, fields get validated, et cetera). So, one needs a rather sophisticated spambot to be able to insert spam into a generic web form.

Remember that if you make it just a tiny bit harder to get your email address (text obfuscation, using an image, etc), you stop almost all spam bots. While it is still easy to get the email address, the added difficulty acts like a deterrent.

share|improve this answer
It makes sense. Thanks very much. I must have confused things thinking that if a server is vulnerable, by appending extra parameters via a proxy a malicious user could add extra recipients while altering the 'from' field, thus creating spams. I was probably wrong. Thanks again. – Lex Feb 18 '13 at 13:18
@Lex: Oh, the 'from' section can be spoofed very easily. See That's a different matter, and has nothing to do with mailto: – Manishearth Feb 18 '13 at 15:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.