原文
23.06.2026
Much have been said about futility of trying to validate email addresses. Generally accepted advice is that you should just send verification link and don’t care about trying to validate it beforehand.
But what if you were really hell-bent on having validation step, and at the same time follow the advice? Apparently some people decided they could to it by… sending spam.
Take this Pangram sign-up form. Filling email field here will perform this request:
curl --request POST --data '{"email": "[email protected]"}' https://www.pangram.com/api/validate-email
And soon enough, without doing anything else, you will get an mysterious email. Whaaa…?
Date: Tue, 23 Jun 2026 15:29:10 +0000
From: "Winwin Insights" <[email protected]>
To: <[email protected]>
Reply-To: <[email protected]>
Subject: Fact of the day: Magnetic
Message-ID: <[email protected]>
Precedence: Bulk
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: base64
PCFET0NUWVBFIGh0bWw+IDxodG1sPiA8aGVhZD4gPG1ldGEgY2hhcnNldD0iVVRGLTgiPiA8L2hl
YWQ+IDxib2R5IHN0eWxlPSJmb250LWZhbWlseTogQXJpYWwsIHNhbnMtc2VyaWY7IGZvbnQtc2l6
ZTogMTZweDsgY29sb3I6ICMzMzM7Ij4gPGRpdiBzdHlsZT0icG9zaXRpb246IGFic29sdXRlOyBs
ZWZ0OiAtOTk5OXB4OyB0b3A6LTk5OTlweDtkaXNwbGF5OiBub25lOyI+SGkgdGhlcmUsPGJyPiBB
IG1hZ25ldGljIGRvbWFpbiBpcyBhIHJlZ2lvbiB3aXRoaW4gYSBtYWduZXRpYyBtYXRlcmlhbCBp
biB3aGljaCB0aGUgbWFnbmV0aXphdGlvbiBpcyBpbiBhIHVuaWZvcm0gZGlyZWN0aW9uLiBUaGlz
IG1lYW5zIHRoYXQgdGhlIGluZGl2aWR1YWwgbWFnbmV0aWMgbW9tZW50cyBvZiB0aGUgYXRvbXMg
YXJlIGFsaWduZWQgd2l0aCBvbmUgYW5vdGhlciBhbmQgdGhleSBwb2ludCBpbiB0aGUgc2FtZSBk
aXJlY3Rpb24uIFdoZW4gY29vbGVkIGJlbG93IGEgdGVtcGVyYXR1cmUgY2FsbGVkIHRoZSBDdXJp
ZSB0ZW1wZXJhdHVyZSwgdGhlIG1hZ25ldGl6YXRpb24gb2YgYSBwaWVjZSBvZiBmZXJyb21hZ25l
dGljIG1hdGVyaWFsIHNwb250YW5lb3VzbHkgZGl2aWRlcyBpbnRvIG1hbnkgc21hbGwgcmVnaW9u
cyBjYWxsZWQgbWFnbmV0aWMgZG9tYWlucy4gVGhlIG1hZ25ldGl6YXRpb24gd2l0aGluIGVhY2gg
ZG9tYWluIHBvaW50cyBpbiBhIHVuaWZvcm0gZGlyZWN0aW9uLCBidXQgdGhlIG1hZ25ldGl6YXRp
b24gb2YgZGlmZmVyZW50IGRvbWFpbnMgbWF5IHBvaW50IGluIGRpZmZlcmVudCBkaXJlY3Rpb25z
LiBNYWduZXRpYyBkb21haW4gc3RydWN0dXJlIGlzIHJlc3BvbnNpYmxlIGZvciB0aGUgbWFnbmV0
aWMgYmVoYXZpb3Igb2YgZmVycm9tYWduZXRpYyBtYXRlcmlhbHMgbGlrZSBpcm9uLCBuaWNrZWws
IGNvYmFsdCBhbmQgdGhlaXIgYWxsb3lzLCBhbmQgZmVycmltYWduZXRpYyBtYXRlcmlhbHMgbGlr
ZSBmZXJyaXRlLiBUaGlzIGluY2x1ZGVzIHRoZSBmb3JtYXRpb24gb2YgcGVybWFuZW50IG1hZ25l
dHMgYW5kIHRoZSBhdHRyYWN0aW9uIG9mIGZlcnJvbWFnbmV0aWMgbWF0ZXJpYWxzIHRvIGEgbWFn
bmV0aWMgZmllbGQuIFRoZSByZWdpb25zIHNlcGFyYXRpbmcgbWFnbmV0aWMgZG9tYWlucyBhcmUg
Y2FsbGVkIGRvbWFpbiB3YWxscywgd2hlcmUgdGhlIG1hZ25ldGl6YXRpb24gcm90YXRlcyBjb2hl
cmVudGx5IGZyb20gdGhlIGRpcmVjdGlvbiBpbiBvbmUgZG9tYWluIHRvIHRoYXQgaW4gdGhlIG5l
eHQgZG9tYWluLiBUaGUgc3R1ZHkgb2YgbWFnbmV0aWMgZG9tYWlucyBpcyBjYWxsZWQgbWljcm9t
YWduZXRpY3MuIE1hZ25ldGljIGRvbWFpbnMgZm9ybSBpbiBtYXRlcmlhbHMgd2hpY2ggaGF2ZSBt
YWduZXRpYyBvcmRlcmluZzsgdGhhdCBpcywgdGhlaXIgZGlwb2xlcyBzcG9udGFuZW91c2x5IGFs
aWduIGR1ZSB0byB0aGUgZXhjaGFuZ2UgaW50ZXJhY3Rpb24uIFRoZXNlIGFyZSB0aGUgZmVycm9t
YWduZXRpYywgZmVycmltYWduZXRpYyBhbmQgYW50aWZlcnJvbWFnbmV0aWMgbWF0ZXJpYWxzLiBQ
YXJhbWFnbmV0aWMgYW5kIGRpYW1hZ25ldGljIG1hdGVyaWFscywgaW4gd2hpY2ggdGhlIGRpcG9s
ZXMgYWxpZ24gaW4gcmVzcG9uc2UgdG8gYW4gZXh0ZXJuYWwgZmllbGQgYnV0IGRvIG5vdCBzcG9u
dGFuZW91c2x5IGFsaWduLCBkbyBub3QgaGF2ZSBtYWduZXRpYyBkb21haW5zLjxicj4gQmVzdCw8
L2Rpdj4gPGRpdiBzdHlsZT0iZm9udC1zaXplOiAwOyBsaW5lLWhlaWdodDogMDsiPiAmIzgyMDM7
IDwvZGl2PiA8L2JvZHk+IDwvaHRtbD4=
Like every self-respecting spam sender, they rotate through many sender domains (not exhaustive!):
apiaryapiaries.com
avaspaintinggallery.com
bonfirebeat.com
catnipblissfulhaven.com
chloesgardeninghaven.com
classmerge.com
endurovistawear.com
fragjoystick.com
gainswiftwave.com
ghostlygourd.com
hydroponicseeders.com
lanternlyric.com
mangomysticfusion.com
northchronicle.com
pasturelandplough.com
platformerboss.com
pyxisvoyager.com
raisetyrvalor.com
rockandrender.com
ryeirrigator.com
sifgoldenshine.com
sipandsweater.com
storybookstage.com
strategycrit.com
thruwaymotors.com
tillageacre.com
venusbases.com
But unlike typical spammer, they really go to the extra mile trying to get their spam delivered, immediately retrying from different servers when rejected (apparently some of their IPs are listed on DNSBLs. hmm, I wonder why…):
Jun 23 16:15:36 milek7.pl postfix/smtpd[404910]: connect from mta2.icicleglimmerfrost.com[31.133.27.229]
Jun 23 16:15:38 milek7.pl postfix/smtpd[404910]: NOQUEUE: reject: RCPT from mta2.icicleglimmerfrost.com[31.133.27.229]: 554 5.7.1 Service unavailable; Client host [31.133.27.229] blocked using spam.spamrats.com; SPAMRATS IP Addresses See: http://www.spamrats.com/bl?31.133.27.229; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<mta2.icicleglimmerfrost.com>
Jun 23 16:15:39 milek7.pl postfix/smtpd[404910]: disconnect from mta2.icicleglimmerfrost.com[31.133.27.229] ehlo=2 starttls=1 mail=1 rcpt=0/1 quit=1 commands=5/6
Jun 23 16:15:39 milek7.pl postfix/smtpd[404910]: connect from mailc.plowdairy.com[93.120.120.78]
Jun 23 16:15:40 milek7.pl postfix/smtpd[404910]: NOQUEUE: reject: RCPT from mailc.plowdairy.com[93.120.120.78]: 554 5.7.1 Service unavailable; Client host [93.120.120.78] blocked using b.barracudacentral.org; http://www.barracudanetworks.com/reputation/?pr=1&ip=93.120.120.78; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<mailc.plowdairy.com>
Jun 23 16:15:41 milek7.pl postfix/smtpd[404910]: disconnect from mailc.plowdairy.com[93.120.120.78] ehlo=2 starttls=1 mail=1 rcpt=0/1 quit=1 commands=5/6
Jun 23 16:15:41 milek7.pl postfix/smtpd[404915]: connect from servidor.classmerge.com[176.113.182.193]
Jun 23 16:15:43 milek7.pl postfix/smtpd[404915]: 53EB982421: client=servidor.classmerge.com[176.113.182.193]
Jun 23 16:15:43 milek7.pl postfix/cleanup[404918]: 53EB982421: message-id=<[email protected]>
Jun 23 16:15:43 milek7.pl postfix/qmgr[404883]: 53EB982421: from=<[email protected]>, size=1301, nrcpt=1 (queue active)
Jun 23 16:15:43 milek7.pl postfix/lmtp[404919]: 53EB982421: to=<[email protected]>, orig_to=<[email protected]>, relay=milek7.pl[dovecot/lmtp], delay=1.8, delays=1.7/0.03/0.05/0.03, dsn=2.0.0, status=sent (250 2.0.0 <[email protected]> dvDAJS+xOmq4LQYA8NhtAw Saved)
Jun 23 16:15:43 milek7.pl postfix/qmgr[404883]: 53EB982421: removed
Jun 23 16:15:44 milek7.pl postfix/smtpd[404915]: disconnect from servidor.classmerge.com[176.113.182.193] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7
This is all extremely dumb, because either you “validated” addresses by delivering spam to them, or if destination does content filtering you get your spam rejected and “validation” fails.
Now I’m really curious how they managed to come up with this, because it seems it took an awful lot of effort to do this. I’m guess there’s some stupid SaaS for “validating” email, through it would be funny if it turns out that some LLM agent went off rails.
(actual transactional mails from Pangram are sent through Mailgun)