HN
Hacker News • 35일 전
이메일 주소를 스팸으로 검증하지 마세요
IMP 4/10
핵심 요약
한 개발자가 Pangram 사의 회원가입 폼에 이메일을 입력하자 실시간 검증 API가 작동하며 곧바로 스팸 메일이 발송되는 현상을 발견했습니다. 개발자들은 사전 유효성 검사를 위한 꼼수로 스팸 발송을 악용해서는 안 되며, 정상적인 인증 링크 발송 방식을 택해야 합니다.
번역된 본문
이메일 주소를 스팸으로 검증하지 마세요 2026년 06월 23일
이메일 주소 검증을 시도하는 것이 얼마나 무의미한지에 대해서는 이미 많은 이야기가 오갔습니다. 일반적으로 권장되는 조언은 그저 인증 링크(Verification link)를 발송하고, 사전에 복잡하게 유효성 검사를 하려고 들지 말라는 것입니다.
하지만 만약 누군가가 정말로 '사전 검증 단계'를 거쳐야만 직성이 풀리지만, 동시에 앞서 말한 '그냥 인증 링크만 보내라'는 조언도 따르고 싶다면 어떻게 해야 할까요? 놀랍게도 일부 사람들은 이를 ...스팸 메일을 발송하는 방식으로 해결하기로 결정했습니다.
'Pangram'의 회원가입 폼을 예로 들어 보겠습니다. 여기에 이메일 입력란을 채우면 다음과 같은 API 요청이 실행됩니다:
curl --request POST --data '{"email": "example@example.com"}' https://www.pangram.com/api/validate-email
그리고 아무런 추가 행동을 하지 않았음에도 곧바로 정체불명의 이메일을 하나 받게 됩니다. 이게 대체 무슨...?
Date: Tue, 23 Jun 2026 15:29:10 +0000 From: "Winwin Insights" aliyah@sifgoldenshine.com To: example@example.com Reply-To: aliyah@sifgoldenshine.com Subject: Fact of the day: Magnetic [중략: Base64로 인코딩된 자기장(Magnetic)에 관한 무의미한 스팸 본문]
여느 자의식 있는 스팸 발송자들처럼, 이들은 수많은 발신자 도메인을 순회하며 사용합니다 (아래 목록은 전체가 아님!):
apiaryapiaries.com avaspaintinggallery.com bonfirebeat.com catnipblissfulhaven.com chloesgardeninghaven.com classmerge.com endurovistawear.com fragjoystick.com gainswiftwave.com ghostlygourd.com hydroponicseeders.com lanternlyric.com mangomysticfusion.com northchronicle.com pasturelandplough.com platformerboss.com pyxisvoyager.com raisetyrvalor.com rockandrender.com ryeirrigator.com sifgoldenshine.com sipandswea...
원문 보기 (영어)
Don’t verify email addresses by sending spam to them 23.06.2026 Much have been said about futility of trying to validate email addresses. Generally accepted advice is that you should just send verification link and don’t care about trying to validate it beforehand. But what if you were really hell-bent on having validation step, and at the same time follow the advice? Apparently some people decided they could to it by… sending spam. Take this Pangram sign-up form . Filling email field here will perform this request: curl --request POST --data '{"email": "example@example.com"}' https://www.pangram.com/api/validate-email And soon enough, without doing anything else, you will get an mysterious email. Whaaa…? Date: Tue, 23 Jun 2026 15:29:10 +0000 From: "Winwin Insights" <aliyah@sifgoldenshine.com> To: <example@example.com> Reply-To: <aliyah@sifgoldenshine.com> Subject: Fact of the day: Magnetic Message-ID: <2111VQOY773L9P98LN32@sifgoldenshine.com> Precedence: Bulk MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: base64 PCFET0NUWVBFIGh0bWw+IDxodG1sPiA8aGVhZD4gPG1ldGEgY2hhcnNldD0iVVRGLTgiPiA8L2hl YWQ+IDxib2R5IHN0eWxlPSJmb250LWZhbWlseTogQXJpYWwsIHNhbnMtc2VyaWY7IGZvbnQtc2l6 ZTogMTZweDsgY29sb3I6ICMzMzM7Ij4gPGRpdiBzdHlsZT0icG9zaXRpb246IGFic29sdXRlOyBs ZWZ0OiAtOTk5OXB4OyB0b3A6LTk5OTlweDtkaXNwbGF5OiBub25lOyI+SGkgdGhlcmUsPGJyPiBB IG1hZ25ldGljIGRvbWFpbiBpcyBhIHJlZ2lvbiB3aXRoaW4gYSBtYWduZXRpYyBtYXRlcmlhbCBp biB3aGljaCB0aGUgbWFnbmV0aXphdGlvbiBpcyBpbiBhIHVuaWZvcm0gZGlyZWN0aW9uLiBUaGlz IG1lYW5zIHRoYXQgdGhlIGluZGl2aWR1YWwgbWFnbmV0aWMgbW9tZW50cyBvZiB0aGUgYXRvbXMg YXJlIGFsaWduZWQgd2l0aCBvbmUgYW5vdGhlciBhbmQgdGhleSBwb2ludCBpbiB0aGUgc2FtZSBk aXJlY3Rpb24uIFdoZW4gY29vbGVkIGJlbG93IGEgdGVtcGVyYXR1cmUgY2FsbGVkIHRoZSBDdXJp ZSB0ZW1wZXJhdHVyZSwgdGhlIG1hZ25ldGl6YXRpb24gb2YgYSBwaWVjZSBvZiBmZXJyb21hZ25l dGljIG1hdGVyaWFsIHNwb250YW5lb3VzbHkgZGl2aWRlcyBpbnRvIG1hbnkgc21hbGwgcmVnaW9u cyBjYWxsZWQgbWFnbmV0aWMgZG9tYWlucy4gVGhlIG1hZ25ldGl6YXRpb24gd2l0aGluIGVhY2gg ZG9tYWluIHBvaW50cyBpbiBhIHVuaWZvcm0gZGlyZWN0aW9uLCBidXQgdGhlIG1hZ25ldGl6YXRp b24gb2YgZGlmZmVyZW50IGRvbWFpbnMgbWF5IHBvaW50IGluIGRpZmZlcmVudCBkaXJlY3Rpb25z LiBNYWduZXRpYyBkb21haW4gc3RydWN0dXJlIGlzIHJlc3BvbnNpYmxlIGZvciB0aGUgbWFnbmV0 aWMgYmVoYXZpb3Igb2YgZmVycm9tYWduZXRpYyBtYXRlcmlhbHMgbGlrZSBpcm9uLCBuaWNrZWws IGNvYmFsdCBhbmQgdGhlaXIgYWxsb3lzLCBhbmQgZmVycmltYWduZXRpYyBtYXRlcmlhbHMgbGlr ZSBmZXJyaXRlLiBUaGlzIGluY2x1ZGVzIHRoZSBmb3JtYXRpb24gb2YgcGVybWFuZW50IG1hZ25l dHMgYW5kIHRoZSBhdHRyYWN0aW9uIG9mIGZlcnJvbWFnbmV0aWMgbWF0ZXJpYWxzIHRvIGEgbWFn bmV0aWMgZmllbGQuIFRoZSByZWdpb25zIHNlcGFyYXRpbmcgbWFnbmV0aWMgZG9tYWlucyBhcmUg Y2FsbGVkIGRvbWFpbiB3YWxscywgd2hlcmUgdGhlIG1hZ25ldGl6YXRpb24gcm90YXRlcyBjb2hl cmVudGx5IGZyb20gdGhlIGRpcmVjdGlvbiBpbiBvbmUgZG9tYWluIHRvIHRoYXQgaW4gdGhlIG5l eHQgZG9tYWluLiBUaGUgc3R1ZHkgb2YgbWFnbmV0aWMgZG9tYWlucyBpcyBjYWxsZWQgbWljcm9t YWduZXRpY3MuIE1hZ25ldGljIGRvbWFpbnMgZm9ybSBpbiBtYXRlcmlhbHMgd2hpY2ggaGF2ZSBt YWduZXRpYyBvcmRlcmluZzsgdGhhdCBpcywgdGhlaXIgZGlwb2xlcyBzcG9udGFuZW91c2x5IGFs aWduIGR1ZSB0byB0aGUgZXhjaGFuZ2UgaW50ZXJhY3Rpb24uIFRoZXNlIGFyZSB0aGUgZmVycm9t YWduZXRpYywgZmVycmltYWduZXRpYyBhbmQgYW50aWZlcnJvbWFnbmV0aWMgbWF0ZXJpYWxzLiBQ YXJhbWFnbmV0aWMgYW5kIGRpYW1hZ25ldGljIG1hdGVyaWFscywgaW4gd2hpY2ggdGhlIGRpcG9s ZXMgYWxpZ24gaW4gcmVzcG9uc2UgdG8gYW4gZXh0ZXJuYWwgZmllbGQgYnV0IGRvIG5vdCBzcG9u dGFuZW91c2x5IGFsaWduLCBkbyBub3QgaGF2ZSBtYWduZXRpYyBkb21haW5zLjxicj4gQmVzdCw8 L2Rpdj4gPGRpdiBzdHlsZT0iZm9udC1zaXplOiAwOyBsaW5lLWhlaWdodDogMDsiPiAmIzgyMDM7 IDwvZGl2PiA8L2JvZHk+IDwvaHRtbD4= Like every self-respecting spam sender, they rotate through many sender domains (not exhaustive!): apiaryapiaries.com avaspaintinggallery.com bonfirebeat.com catnipblissfulhaven.com chloesgardeninghaven.com classmerge.com endurovistawear.com fragjoystick.com gainswiftwave.com ghostlygourd.com hydroponicseeders.com lanternlyric.com mangomysticfusion.com northchronicle.com pasturelandplough.com platformerboss.com pyxisvoyager.com raisetyrvalor.com rockandrender.com ryeirrigator.com sifgoldenshine.com sipandsweater.com storybookstage.com strategycrit.com thruwaymotors.com tillageacre.com venusbases.com But unlike typical spammer, they really go to the extra mile trying to get their spam delivered, immediately retrying from different servers when rejected (apparently some of their IPs are listed on DNSBLs. hmm, I wonder why…): Jun 23 16:15:36 milek7.pl postfix/smtpd[404910]: connect from mta2.icicleglimmerfrost.com[31.133.27.229] Jun 23 16:15:38 milek7.pl postfix/smtpd[404910]: NOQUEUE: reject: RCPT from mta2.icicleglimmerfrost.com[31.133.27.229]: 554 5.7.1 Service unavailable; Client host [31.133.27.229] blocked using spam.spamrats.com; SPAMRATS IP Addresses See: http://www.spamrats.com/bl?31.133.27.229; from=<lyla@icicleglimmerfrost.com> to=<example@example.com> proto=ESMTP helo=<mta2.icicleglimmerfrost.com> Jun 23 16:15:39 milek7.pl postfix/smtpd[404910]: disconnect from mta2.icicleglimmerfrost.com[31.133.27.229] ehlo=2 starttls=1 mail=1 rcpt=0/1 quit=1 commands=5/6 Jun 23 16:15:39 milek7.pl postfix/smtpd[404910]: connect from mailc.plowdairy.com[93.120.120.78] Jun 23 16:15:40 milek7.pl postfix/smtpd[404910]: NOQUEUE: reject: RCPT from mailc.plowdairy.com[93.120.120.78]: 554 5.7.1 Service unavailable; Client host [93.120.120.78] blocked using b.barracudacentral.org; http://www.barracudanetworks.com/reputation/?pr=1&ip=93.120.120.78; from=<august@plowdairy.com> to=<example@example.com> proto=ESMTP helo=<mailc.plowdairy.com> Jun 23 16:15:41 milek7.pl postfix/smtpd[404910]: disconnect from mailc.plowdairy.com[93.120.120.78] ehlo=2 starttls=1 mail=1 rcpt=0/1 quit=1 commands=5/6 Jun 23 16:15:41 milek7.pl postfix/smtpd[404915]: connect from servidor.classmerge.com[176.113.182.193] Jun 23 16:15:43 milek7.pl postfix/smtpd[404915]: 53EB982421: client=servidor.classmerge.com[176.113.182.193] Jun 23 16:15:43 milek7.pl postfix/cleanup[404918]: 53EB982421: message-id=<BY7HI0WM9LDYW2J4J2KQ@classmerge.com> Jun 23 16:15:43 milek7.pl postfix/qmgr[404883]: 53EB982421: from=<sage@classmerge.com>, size=1301, nrcpt=1 (queue active) Jun 23 16:15:43 milek7.pl postfix/lmtp[404919]: 53EB982421: to=<me@milek7.pl>, orig_to=<example@example.com>, relay=milek7.pl[dovecot/lmtp], delay=1.8, delays=1.7/0.03/0.05/0.03, dsn=2.0.0, status=sent (250 2.0.0 <me@milek7.pl> dvDAJS+xOmq4LQYA8NhtAw Saved) Jun 23 16:15:43 milek7.pl postfix/qmgr[404883]: 53EB982421: removed Jun 23 16:15:44 milek7.pl postfix/smtpd[404915]: disconnect from servidor.classmerge.com[176.113.182.193] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7 This is all extremely dumb, because either you “validated” addresses by delivering spam to them, or if destination does content filtering you get your spam rejected and “validation” fails. Now I’m really curious how they managed to come up with this, because it seems it took an awful lot of effort to do this. I’m guess there’s some stupid SaaS for “validating” email, through it would be funny if it turns out that some LLM agent went off rails. (actual transactional mails from Pangram are sent through Mailgun)